Modern Application Framework Issues and Serialization GWEB Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A penetration tester is attempting to exploit an insecure deserialization vulnerability in a Java application. The application has a global deserialization filter that rejects classes from a known blacklist. The tester has identified a gadget chain that uses a class not on the blacklist. Which additional condition is necessary for the exploit to achieve code execution?

   • AThe gadget chain must be able to invoke a method that performs a sensitive operation, such as writing a file or executing a command.
   • BThe application must be accessible over the internet.
   • CThe application must be using a 64-bit JVM.
   • DThe application must be running with root privileges.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A development team is migrating a legacy Java application that uses native serialization to a modern framework. The new framework offers a built-in deserialization feature that is enabled by default and supports polymorphic typing. The team has a strict deadline and limited resources. Which approach best reduces risk while meeting the deadline?

   • AKeep the legacy native serialization code and add a security manager.
   • BRewrite the entire data layer to use JSON with schema validation.
   • CUse the framework's default configuration and rely on network segmentation to protect the service.
   • DDisable the framework's polymorphic typing feature and configure a global deserialization allow-list.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A development team is building a REST API that accepts JSON payloads. To reduce boilerplate, they use a popular Java library that automatically converts incoming JSON into Java objects. During a code review, you notice the library is configured to use a polymorphic type-handling feature that allows the JSON to specify the concrete class to instantiate. The API only needs to handle a fixed set of DTO classes. Which mitigation is most effective to prevent malicious class instantiation?

   • AEnable a global Java security manager to restrict file and network access for all deserialization operations.
   • BAdd a filter that rejects any JSON payload containing the string 'java.lang.Runtime'.
   • CSwitch from JSON to XML serialization because XML parsers are inherently safer for untrusted data.
   • DConfigure the library to use a strict allow-list of permitted DTO classes for polymorphic deserialization.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A team is building a microservices architecture where services communicate via JSON messages. They want to avoid deserialization vulnerabilities. Which approach is the most secure?

   • AUse a binary serialization format like Protocol Buffers without schema validation
   • BUse a schema validation library that rejects unknown fields and types
   • CEncrypt all messages with TLS and assume they are safe
   • DUse a custom deserializer that ignores all type information
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a known risk associated with a framework's native serialization feature?

   • AIt may automatically deserialize objects from request parameters without developer intervention
   • BIt may require additional configuration to enable serialization
   • CIt may use a proprietary format that is difficult to read
   • DIt may serialize objects faster than other libraries
   Reveal Solution Discussion Select an answer first