Exam CAS-004 topic 1 question 556 discussion

The application is vulnerable to command injection due to improper handling of user-supplied input. By appending ||whoami to the IP parameter, the engineer was able to execute an additional shell command. || is a shell logical operator that executes the command following it if the preceding command fails. However, depending on how the input is handled, it may simply concatenate commands, leading to unintended execution. This indicates that the application directly incorporates user input into a system command without proper validation or sanitization. Proper input sanitization eliminates the possibility of injecting unintended commands.roper input sanitization eliminates the possibility of injecting unintended commands.

Ans. D. Input sanitization This recommendation is necessary to prevent command injection vulnerabilities, as demonstrated by the ability to invoke whoami through the URL. Proper input sanitization would help ensure that only valid IP addresses are accepted and prevent unauthorized command execution.