PT0-002 Question #612: Real Exam Question with Answer & Explanation

Question

During a security assessment of a web application, a penetration tester discovers a vulnerability that allows users to pass a URL to the web application and retrieve information from an internal web application hosted on a different network. Which of the following remediation actions should the penetration tester include? (Choose two.)

Options

• AInput validation
• BSecrets management
• CNetwork segmentation
• DCertificate management
• EPatch management
• FMultifactor authentication

Explanation

The vulnerability described is likely Server-Side Request Forgery (SSRF), where an attacker can make a server-side application issue requests to an arbitrary domain.

Common mistakes.

• B. Secrets management is about securely storing and managing credentials, which is not the primary fix for an SSRF vulnerability.
• D. Certificate management deals with SSL/TLS certificates and their lifecycle, unrelated to preventing a web application from making unauthorized requests.
• E. Patch management addresses software bugs and vulnerabilities, but doesn't specifically prevent the logic flaw of allowing arbitrary URL requests without validation.
• F. Multifactor authentication secures user logins but does not prevent a server-side vulnerability exploited by an already authenticated or unauthenticated attacker.

Concept tested. Server-Side Request Forgery (SSRF) remediation

Reference. https://owasp.org/www-community/attacks/Server_Side_Request_Forgery

No community discussion yet for this question.