A penetration test report identifies that the organization's web application is vulnerable to insecure deserialization. The development team asks the security analyst to explain the appropriate mitigation. What should the analyst recommend?

Question

Accepted Answer

A. Avoid deserializing data from untrusted sources and implement integrity checks such as digital signatures on serialized objects. Insecure deserialization vulnerabilities occur when applications deserialize data from untrusted sources without validation, enabling attackers to execute arbitrary code. The mitigations are to avoid deserializing untrusted data and to enforce integrity verification (digital signatures or HMACs) on serialized objects before deserialization. The CySA+ Vulnerability Management domain covers mitigation controls for application vulnerabilities.

A penetration test report identifies that the organization's web application is vulnerable to insecure deserialization. The development team asks the security analyst to explain the appropriate mitigation. What should the analyst recommend?

Related Questions

Discussion