CS0-003 · Question #156
An analyst has received an IPS event notification from the SIEM stating an IP address, which is known to be malicious, has attempted to exploit a zero-day vulnerability on several web servers. The…
The correct answer is A. Limit user creation to administrators only. The exploit snippet attempts to create a new user with administrative privileges, so limiting user creation to administrators is the best mitigation.
Question
An analyst has received an IPS event notification from the SIEM stating an IP address, which is known to be malicious, has attempted to exploit a zero-day vulnerability on several web servers. The exploit contained the following snippet:
/wp- json/trx_addons/V2/get/sc_layout?sc=wp_insert_user&role=administrator Which of the following controls would work best to mitigate the attack represented by this snippet?
Options
- ALimit user creation to administrators only.
- BLimit layout creation to administrators only.
- CSet the directory trx_addons to read only for all users.
- DSet the directory V2 to read only for all users.
How the community answered
(40 responses)- A60% (24)
- B5% (2)
- C23% (9)
- D13% (5)
Why each option
The exploit snippet attempts to create a new user with administrative privileges, so limiting user creation to administrators is the best mitigation.
The exploit snippet `wp_insert_user&role=administrator` clearly indicates an attempt to create a new user account with administrative privileges using a WordPress function. Limiting the ability to create new user accounts to only authorized administrators, typically through robust access controls and disabling public registration, directly mitigates this specific attack vector.
While `sc_layout` is present, the critical part of the exploit is `wp_insert_user&role=administrator`, indicating user creation, not just layout creation, as the primary objective.
Setting a directory to read-only would likely disrupt legitimate application functionality and does not address the logic of exploiting an application function to create a user.
Similar to option C, making the `V2` directory read-only would interfere with the application's API and does not prevent the exploitation of the `wp_insert_user` function.
Concept tested: Web application vulnerability mitigation
Source: https://docs.microsoft.com/en-us/azure/security/fundamentals/application-security
Topics
Community Discussion
No community discussion yet for this question.