A company suspects a web server may have been infiltrated by a rival corporation.
The security engineer reviews the web server logs and finds the following: ls -l -a /usr/heinz/public; cat ./config/db.yml The security engineer looks at the code with a developer, and they determine the log entry is created when the following line is run: system ("ls -l -a #{path}") Which of the following is an appropriate security control the company should implement?
Click on the arrows to vote for the correct answer
A. B. C. D.C.
The given scenario suggests that a security engineer has identified a suspicious log entry on a web server, indicating that a system command is executed with a user-specified input 'path.' The engineer worked with a developer to determine that the log entry is created when the following code is executed:
system ("ls -l -a #{path}")
The primary concern in this situation is that the input 'path' could be exploited to inject malicious commands, potentially leading to unauthorized access or data theft. To address this risk, the company needs to implement an appropriate security control.
Let's review each answer option and see which one is the most suitable control in this case:
A. Restrict directory permissions to read-only access: This control could help prevent unauthorized access to the directory, but it does not address the issue of command injection via user input.
B. Use server-side processing to avoid XSS vulnerabilities in path input: This control is unrelated to the issue at hand, as it deals with cross-site scripting (XSS) vulnerabilities that could arise from user input on web pages.
C. Separate the items in the system call to prevent command injection: This control would help mitigate the risk of command injection by separating user input from the command being executed. By doing so, it becomes more difficult for an attacker to inject malicious commands into the system. Therefore, this is the correct answer.
D. Parameterize a query in the path variable to prevent SQL injection: This control is also unrelated to the issue at hand, as it deals with preventing SQL injection vulnerabilities in database queries.
In conclusion, the most appropriate security control the company should implement in this scenario is to separate the items in the system call to prevent command injection.