312-50 Question 438
Single answer▪ Serverless ComputingA company exposes a public HTTP endpoint through API Gateway to invoke a serverless function that processes uploaded JSON data and stores results in a cloud database. During a security assessment, an ethical hacker discovers that by sending a specially crafted request, the function returns detailed stack traces containing environment variable names and internal service endpoints. Which finding represents the most serious security issue that should be remediated first?
- A
The function is leaking sensitive implementation details through verbose error handling, which can aid further attacks against serverless resources
- B
The API Gateway should be replaced with a traditional load balancer because serverless gateways are inherently insecure
- C
The use of JSON in the request body is the main vulnerability because JSON is not suitable for serverless applications
- D
The cloud database should be migrated on-premises because serverless functions cannot securely interact with managed databases
Show answer and explanation
Correct answer: A
Explanation
This question tests practical understanding of a common serverless security issue: information disclosure through verbose error handling. In serverless applications, functions often run with cloud permissions and interact with managed services, so exposing stack traces and environment details can significantly increase attacker knowledge of the environment. Best practice is to return sanitized error messages to clients, log detailed exceptions only to protected logging systems, and avoid storing secrets directly in plain environment variables when possible. This aligns with secure coding guidance from major cloud providers and OWASP recommendations for error handling and minimizing information leakage. In a CEH context, the key point is recognizing that the most critical issue is the leakage of internal details that can enable further exploitation, not the use of serverless components themselves.
- A. Correct.
Correct. Detailed stack traces, environment variable names, and internal endpoints provide attackers with valuable reconnaissance data. In serverless environments, environment variables may reference secrets, service names, bucket names, database identifiers, or other architecture details. Exposing this information can help an attacker chain additional attacks such as privilege abuse, endpoint targeting, or input manipulation. Proper remediation includes generic error responses, secure logging, and keeping sensitive details only in protected logs.
- B. Incorrect.
Incorrect. API Gateway products are not inherently insecure and are widely used securely in production. The issue described is not the use of an API gateway itself, but the application-level error handling in the serverless function. Replacing the gateway would not address the core information disclosure vulnerability.
- C. Incorrect.
Incorrect. JSON is a standard and appropriate format for API requests in serverless architectures. The vulnerability is not the data format but the application's behavior when handling malformed or crafted input. An attacker may use JSON payloads to trigger exceptions, but JSON itself is not the root cause.
- D. Incorrect.
Incorrect. Managed cloud databases can be securely accessed by serverless functions when proper IAM roles, network controls, and secret management are used. Moving the database on-premises does not solve the immediate issue of information leakage from verbose error messages.