Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
CompTIA CySA+ Cybersecurity Analyst · CompTIA
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
From study guide: There are also other types of attack that target the way a server parses an XML file submitted for upload or XML data submitted as a URL: XML External Entity (XXE)—This type of attack embeds a request for a local resource, such as the server’s password file. This is exactly what happens here.
The attacker references /etc/shadow using the &ent; entity in the XML code. The XML parser replaces &ent; with the contents of /etc/shadow during the parsing process. The password hashes from /etc/shadow are displayed where the <lastName> value would normally appear. If the vulnerable application returns this data in a response (like a web page or an API), the attacker can see and retrieve the hashes.
The security analyst is validating for XML External Entity (XXE) Injection vulnerability. In this scenario, the XML snippet includes an external entity (<!ENTITY ent SYSTEM "file:///etc/shadow">) that references a file on the server. If the web application improperly processes XML input, it could potentially resolve this entity and include the contents of the /etc/shadow file in the XML response, which could expose sensitive information. XXE vulnerabilities can lead to various attacks, including data exfiltration, denial of service, and server-side request forgery (SSRF).