CSSLP · Question #164
Which of the following vulnerabilities occurs when an application directly uses or concatenates potentially hostile input with data file or stream functions?
The correct answer is B. Malicious file execution. The vulnerability occurring when an application uses hostile input with data file or stream functions, leading to unauthorized operations or code execution, is known as malicious file execution.
Question
Which of the following vulnerabilities occurs when an application directly uses or concatenates potentially hostile input with data file or stream functions?
Options
- AInsecure cryptographic storage
- BMalicious file execution
- CInsecure communication
- DInjection flaw
How the community answered
(18 responses)- A6% (1)
- B94% (17)
Why each option
The vulnerability occurring when an application uses hostile input with data file or stream functions, leading to unauthorized operations or code execution, is known as malicious file execution.
Insecure cryptographic storage refers to vulnerabilities where sensitive data is not properly encrypted or protected when stored.
Malicious file execution is a specific type of attack outcome where an application's handling of file or stream input allows an attacker to control which files are executed or included, or to execute arbitrary system commands via those functions. This vulnerability arises directly from concatenating hostile input with functions meant for file or stream operations, leading to an attacker-controlled execution flow.
Insecure communication involves transmitting sensitive data over unprotected channels or using weak encryption protocols.
An injection flaw is a broader category describing the act of inserting hostile input, but 'Malicious file execution' specifically describes the vulnerability that occurs when this hostile input targets and manipulates file or stream functions for unauthorized execution.
Concept tested: Web Application Security - Malicious File Execution
Source: https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/A1_2017-Injection.html
Topics
Community Discussion
No community discussion yet for this question.