A penetration tester finds that an application responds with the contents of the /etc/passwd file when the following payload is sent: ```xml &foo; ``` Which of the following should the tester recommend in the report to best prevent this type of vulnerability?

Disable the use of external entities.

Drop all excessive file permissions with chmod o-rwx.

Ensure the requests application access logs are reviewed frequently.

Implement a WAF to filter all incoming requests.

PT0-003: A penetration tester finds that an application…

Question

A penetration tester finds that an application responds with the contents of the /etc/passwd file when the following payload is sent: ```xml <?xml version="1"?> <!DOCTYPE data [ <!ENTITY foo SYSTEM "file:///etc/passwd" ]> <test>&foo;</test> ``` Which of the following should the tester recommend in the report to best prevent this type of vulnerability?

A. Drop all excessive file permissions with chmod o-rwx.
B. Ensure the requests application access logs are reviewed frequently.
C. Disable the use of external entities. Correct
D. Implement a WAF to filter all incoming requests.

Explanation

The payload declares an external entity that points to file:///etc/passwd, so this is an XML external entity (XXE) injection. Configuring the XML parser to disable external entities and DTD processing removes the root cause. Changing file permissions would break the system since /etc/passwd must be world-readable, log review only detects the attack, and a WAF can be bypassed and does not fix the parser.