Which of the following it the BEST solution to mitigate this type of attack?

After a remote command execution incident occurred on a web server, a security analyst found the following piece of code in an XML file:

Which of the following it the BEST solution to mitigate this type of attack?
A . Implement a better level of user input filters and content sanitization.
B . Property configure XML handlers so they do not process sent parameters coming from user inputs.
C . Use parameterized Queries to avoid user inputs horn being processed by the server.
D . Escape user inputs using character encoding conjoined with whitelisting

View Answer

Answer: A

Explanation:

The piece of code in the XML file is an example of a command injection attack, which is a type of attack that exploits insufficient input validation or output encoding to execute arbitrary commands on a server or system2 The attacker can inject malicious commands into an XML element that is processed by an XML handler on the server, and cause the server to execute those commands. The best solution to mitigate this type of attack is to implement a better level of user input filters and content sanitization, which means checking and validating any user input before processing it, and removing or encoding any potentially harmful characters or commands.

Reference: 2 Command Injection – OWASP