Modern Application Framework Issues and Serialization GWEB Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security analyst is reviewing a Java application that uses a custom ObjectInputFilter. The filter is configured to reject any class that is not in the application's package. However, the analyst finds that the application uses a library that has a gadget chain that starts with a class in the application's package. What is the most effective mitigation?

   • ARemove the dangerous method from the application's class that is used as the entry point
   • BChange the filter to reject all classes except those in a smaller sub-package
   • CAdd the library's classes to the filter's allow-list
   • DUse a block-list to reject the specific gadget class from the library
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A developer is using a PHP framework that automatically unserializes data from a signed cookie. The framework uses a secret key to sign the cookie. What is the remaining risk?

   • AThe cookie could be read by an attacker on the network
   • BThe cookie could be too large and cause a denial of service
   • CThe secret key could be leaked, allowing an attacker to forge a signed cookie
   • DThe cookie could be replayed from a previous session
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A .NET application deserializes XML data from a partner system using XmlSerializer. The XML contains a field that specifies a type name. The application only needs to process a fixed set of DTOs. Which code change would most effectively reduce the risk of insecure deserialization?

   • AUse a try-catch block around the deserialization call to handle exceptions gracefully.
   • BDisable DTD processing in the XML parser to prevent XXE attacks.
   • CValidate the XML against an XSD schema before deserialization.
   • DSet the XmlSerializer to use a custom SerializationBinder that restricts types to a known allow-list.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Python application uses pickle to deserialize data from a user-uploaded file. The application only needs to read a dictionary of configuration values. Which mitigation is most appropriate?

   • ABase64-encode the file before unpickling.
   • BUse a regular expression to remove any 'R' opcode from the pickle stream.
   • CUse a try-except block to catch exceptions during unpickling.
   • DUse a custom Unpickler that overrides find_class to allow only the dict and str classes.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security engineer is reviewing a Python web application that uses pickle to load a user profile from a Redis cache. The cache is populated by an external service that the application trusts. Which condition would make this practice unsafe?

   • AThe external service is authenticated and only sends data that was originally created by the application.
   • BThe Redis cache can be written to by any user who can reach the network, and the application does not verify the source of the cached data.
   • CThe application uses a fixed secret to sign the pickle data before storing it in Redis.
   • DThe Redis cache is accessible only from the application server's private network.
   Reveal Solution Discussion Select an answer first