Remote Code Execution (RCE) WAHS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A PHP application uses `preg_replace` with the `/e` modifier to perform a search-and-replace on user input. The developer is aware of the risk and has added a filter that removes the characters `;`, `|`, and `&`. Which payload could still achieve code execution?

   • A`<?php system('whoami'); ?>`
   • B`system('whoami')`
   • C`${`id`}`
   • D`${phpinfo()}`
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A web application allows users to upload PDF files that are then stored on the server. A security audit finds that the application checks only the file extension and content-type header. Which additional control would most effectively reduce the risk of RCE via file upload?

   • ASet the file permissions to read-only after upload.
   • BStore the files in a database as BLOBs instead of on the filesystem.
   • CUse a random file name with a .pdf extension and store it in the web root.
   • DValidate the file's magic bytes and re-encode the file to a safe format.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A Ruby on Rails application has a legacy endpoint that uses `eval()` to process a user-supplied mathematical formula. The application is deployed on a shared hosting environment where the web server runs as a low-privileged user. A developer proposes to replace `eval()` with a safe arithmetic parser. Which additional control would be most important to implement as defense-in-depth?

   • AAdd a WAF rule to block requests containing parentheses.
   • BUse a regular expression to validate the formula before parsing.
   • CRun the application in a sandboxed container with no network access.
   • DDisable Ruby's `eval` method in the application's runtime.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A Java application deserializes a cookie that contains a serialized object. The development team wants to prevent deserialization attacks without breaking existing functionality. They have identified that the application only needs to deserialize a few known classes. Which approach is the most secure and practical?

   • ASwitch to JSON serialization for all session data.
   • BEncrypt the cookie with a secret key.
   • CImplement a custom deserialization filter that allows only the known classes.
   • DUse a WAF to block requests with suspicious cookie values.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A Java application deserializes objects from a message queue. The application uses a custom `ObjectInputStream` that overrides `resolveClass()` to allow only classes in a specific package. A penetration tester finds a gadget chain that uses a class from that package. Which of the following is the most effective mitigation?

   • AEncrypt the message queue traffic so attackers cannot inject malicious objects.
   • BAdd a WAF rule to block messages containing the gadget class name.
   • CReplace the custom `ObjectInputStream` with a safe deserialization library that uses allowlists based on the actual class hierarchy.
   • DUse a deny list of known gadget classes in the custom `ObjectInputStream`.
   Reveal Solution Discussion Select an answer first