nerdexam
(ISC)2

CSSLP · Question #164

Which of the following vulnerabilities occurs when an application directly uses or concatenates potentially hostile input with data file or stream functions?

The correct answer is B. Malicious file execution. The vulnerability occurring when an application uses hostile input with data file or stream functions, leading to unauthorized operations or code execution, is known as malicious file execution.

Secure Software Implementation

Question

Which of the following vulnerabilities occurs when an application directly uses or concatenates potentially hostile input with data file or stream functions?

Options

  • AInsecure cryptographic storage
  • BMalicious file execution
  • CInsecure communication
  • DInjection flaw

How the community answered

(18 responses)
  • A
    6% (1)
  • B
    94% (17)

Why each option

The vulnerability occurring when an application uses hostile input with data file or stream functions, leading to unauthorized operations or code execution, is known as malicious file execution.

AInsecure cryptographic storage

Insecure cryptographic storage refers to vulnerabilities where sensitive data is not properly encrypted or protected when stored.

BMalicious file executionCorrect

Malicious file execution is a specific type of attack outcome where an application's handling of file or stream input allows an attacker to control which files are executed or included, or to execute arbitrary system commands via those functions. This vulnerability arises directly from concatenating hostile input with functions meant for file or stream operations, leading to an attacker-controlled execution flow.

CInsecure communication

Insecure communication involves transmitting sensitive data over unprotected channels or using weak encryption protocols.

DInjection flaw

An injection flaw is a broader category describing the act of inserting hostile input, but 'Malicious file execution' specifically describes the vulnerability that occurs when this hostile input targets and manipulates file or stream functions for unauthorized execution.

Concept tested: Web Application Security - Malicious File Execution

Source: https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/A1_2017-Injection.html

Topics

#Malicious File Execution#Input Validation#File System Vulnerabilities#Code Execution

Community Discussion

No community discussion yet for this question.

Full CSSLP Practice