CyberCertPrepWeb App FundamentalsCommon Web Vulnerabilities (OWASP Intro)EASYFree question
An application uses 'eval(userInput)' in a Node.js API endpoint to process mathematical expressions. An attacker submits 'require("child_process").execSync("id")'. What OWASP category does this represent?
- A.A02 Cryptographic Failures
- B.A05 Security Misconfiguration
- C.A03 Injection - specifically code injection/Remote Code Execution via eval(): the application passes untrusted input to an interpreter (Node.js's eval) which treats it as code and executes it with the process's full privileges
- D.A08 Software and Data Integrity Failures
Why C is correct
eval() in JavaScript (and similar functions in other languages: Python exec(), PHP eval(), Ruby eval()) is one of the most dangerous functions because it treats strings as executable code. This is server-side JavaScript injection / code injection under A03 Injection. Mitigation: never use eval() with user input. For math expressions, use a dedicated safe expression parser library (e.g., math.js, expr-eval) that only evaluates mathematical expressions and cannot access Node.js APIs.
Know someone studying for Web App Fundamentals? Send them this one.