Modern Application Framework Issues and Serialization GWEB Practice Questions (Page 8)

Questions 36–39

1. 36expert · hard

   A security analyst is reviewing a Java web application that accepts a base64-encoded serialized object from an HTTP cookie. The application uses a common serialization library that supports object graphs. The analyst suspects an insecure deserialization vulnerability. Which observation would most strongly confirm that an attacker can achieve remote code execution?

   • AThe application uses the default Java serialization format rather than a JSON-based library.
   • BThe application's classpath contains a gadget library such as Apache Commons Collections, and the deserialization call does not restrict allowed classes.
   • CThe cookie value is base64-encoded, which is a common encoding for serialized Java objects.
   • DThe application logs a stack trace when the cookie is malformed, revealing the serialization library version.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A code review finds that a Java application uses ObjectInputStream.readObject() on data received from a socket. The data is a serialized object that the application expects to be a specific DTO. Which additional control would be most effective to prevent deserialization attacks?

   • AUse a try-catch block to catch ClassNotFoundException and continue.
   • BWrap the socket input in a BufferedReader to improve performance.
   • CCheck the length of the incoming data and reject payloads larger than a threshold.
   • DUse a custom ObjectInputStream that overrides resolveClass() to allow only the expected DTO class.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A .NET application deserializes a binary payload from a message queue. The payload is a serialized object graph that may contain multiple types. The team wants to enforce a strict allow-list of types. Which approach should they use?

   • AUse a try-catch block to ignore deserialization errors.
   • BSet the BinaryFormatter to use a low trust level.
   • CUse a regular expression to validate the binary payload before deserialization.
   • DUse a custom SerializationBinder that throws an exception for any type not in the allow-list.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A developer is using a popular JavaScript framework that automatically binds query parameters to server-side objects. The framework has a known vulnerability that allows mass assignment. What is the most effective mitigation?

   • ADefine an explicit allow-list of bindable fields in the framework's configuration
   • BUse a block-list of dangerous field names such as 'role' and 'admin'
   • CRename all object properties to obscure names
   • DDisable the framework's built-in validation
   Reveal Solution Discussion Select an answer first