Modern Application Framework Issues and Serialization GWEB Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A Ruby on Rails application uses Marshal.load to read a session object from a cookie. The team is refactoring to improve security. Which change best reduces the risk of deserialization attacks?

   • AKeep Marshal but sign the cookie with a secret key.
   • BEncrypt the cookie with AES to prevent attackers from reading the serialized data.
   • CUse Marshal but restrict the allowed classes by overriding ClassLoader.
   • DReplace Marshal with JSON for session data and store the session on the server side.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is reviewing code that reads a byte array from a message queue and passes it to a Java ObjectInputStream. The analyst notices that the application does not use any ObjectInputFilter. What is the primary risk?

   • AThe application may deserialize an attacker-controlled object graph that triggers arbitrary code execution
   • BThe application may leak memory because the byte array is not closed
   • CThe application may allow an attacker to read arbitrary files from the server
   • DThe application may crash due to a malformed byte array
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A developer is reviewing a modern JavaScript framework-based web application. Which of the following is a common framework-related security issue that should be addressed?

   • AUsing a template engine that automatically escapes output by default
   • BUsing parameterized queries for all database access
   • CLeaving the framework's default administrative credentials unchanged in production
   • DEnabling HTTP Strict Transport Security (HSTS) on the application's domain
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is evaluating a new web framework for a project that will handle sensitive user data. The framework uses a default configuration that automatically deserializes request body data into model objects. What should the team do to assess the framework's security posture?

   • ADisable all logging to reduce the attack surface
   • BAssume the framework is secure because it is widely used
   • CImmediately replace the framework with a custom-built serializer
   • DReview the framework's documentation for known deserialization vulnerabilities and check the version against the CVE database
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security review finds that a PHP application uses unserialize() on data from a POST parameter. The application expects an array of user preferences. Which mitigation is most effective?

   • AWrap the unserialize() call in a try-catch block to suppress exceptions.
   • BPass the allowed_classes option to unserialize() to restrict object instantiation to a safe list.
   • CBase64-encode the input before unserialize() to prevent special characters.
   • DUse htmlspecialchars() on the input before unserialize() to sanitize the data.
   Reveal Solution Discussion Select an answer first