312-50 Question 285
Single answer▪ Web Server AttacksDuring an authorized assessment, you identify that a company’s Apache web server exposes directory listing on /icons/ and returns verbose server banners showing the exact Apache and OpenSSL versions. A review of the site also shows that an old backup file, config.php.bak, is accessible over HTTP and contains database credentials. The client asks which finding represents the most direct web server attack path that could immediately lead to compromise of backend data without first exploiting a memory-corruption vulnerability in Apache itself. What should you report as the most critical issue?
- A
The accessible backup file because it directly discloses application secrets that can be used to access backend systems
- B
The directory listing on /icons/ because browsing static files alone typically provides immediate database compromise
- C
The verbose server banner because version disclosure by itself directly grants database access
- D
The presence of OpenSSL because encrypted services inherently increase the attack surface more than exposed credentials
Show answer and explanation
Correct answer: A
Explanation
The most critical finding is the publicly accessible backup file containing database credentials. In web server attack scenarios, misconfigurations that expose sensitive files often provide a faster and more reliable attack path than attempting to exploit the web server software itself. This aligns with common hardening guidance: disable indexing where unnecessary, suppress unnecessary version disclosure, and prevent access to backup, temporary, source, and configuration files. Apache security best practices commonly include disabling directory indexing unless explicitly needed, minimizing the ServerTokens/ServerSignature information exposed, and using file-access controls to block unintended artifacts. OWASP guidance on sensitive data exposure and secure configuration also supports prioritizing exposed secrets because they frequently enable immediate unauthorized access to dependent systems such as databases. In this scenario, directory listing and banner disclosure matter, but the downloadable backup file is the clearest path to backend compromise.
- A. Correct.
Correct. An exposed backup file containing database credentials is a direct path to compromise. In real environments, .bak, .old, .zip, and similar files often expose source code, credentials, connection strings, or API keys. If the credentials are valid and network access exists, an attacker may immediately access the backend database or reuse the credentials elsewhere. This is a practical web server attack scenario involving sensitive file exposure due to misconfiguration, not exploitation of the web server binary itself.
- B. Incorrect.
Incorrect. Directory listing is a security weakness because it can reveal file names, scripts, backups, administrative paths, or sensitive content that aids further attack. However, listing /icons/ by itself does not usually provide immediate database compromise. Its severity depends on what is exposed. In this scenario, the backup file with credentials is the more direct and critical issue.
- C. Incorrect.
Incorrect. Verbose banners help attackers fingerprint software versions and may support targeted exploitation or vulnerability matching. However, banner disclosure alone does not directly grant access to backend data. It is an information disclosure issue that increases attacker efficiency, but it is less immediately exploitable than exposed credentials in a downloadable backup file.
- D. Incorrect.
Incorrect. The mere use of OpenSSL is not a vulnerability. OpenSSL is a legitimate cryptographic library used to secure communications. Risk would depend on a specific vulnerable version or misconfiguration, but the scenario does not establish an exploitable OpenSSL flaw. Exposed credentials in a web-accessible backup file are far more actionable.