Node.js Risk Assessment & Management 5 — Questions and Answers
Question 1: What risk does calling child_process.exec() with shell interpolation of user data introduce compared to child_process.execFile()?
- execFile() is slower than exec()
- exec() passes input through a shell, enabling command injection; execFile() does not invoke a shell (Correct answer)
- execFile() cannot accept arguments
- exec() disables stderr capture
Correct answer: exec() passes input through a shell, enabling command injection; execFile() does not invoke a shell
exec() concatenates arguments into a shell command string, while execFile() passes arguments directly to the OS without shell interpretation, eliminating shell injection.
Question 2: Which package.json field should be audited regularly to reduce supply-chain risk from transitive dependencies?
- scripts.postinstall hooks across all dependencies (Correct answer)
- The 'main' field of each package
- The 'exports' map
- The 'engines' field
Correct answer: scripts.postinstall hooks across all dependencies
Malicious packages often use postinstall scripts to execute arbitrary code at install time, making them a critical supply-chain attack vector.
Question 3: A Node.js microservice exposes an admin endpoint without authentication because it is 'internal only'. What risk does this create?
- Higher latency on admin calls
- Server-side request forgery (SSRF) or lateral movement if any service is compromised (Correct answer)
- Larger response payloads
- Slower DNS resolution
Correct answer: Server-side request forgery (SSRF) or lateral movement if any service is compromised
An attacker who compromises any service on the same network can call the unauthenticated admin endpoint, achieving lateral movement without additional credentials.
Question 4: What is the purpose of setting the httpOnly flag on session cookies in a Node.js application?
- Restricts the cookie to HTTPS connections only
- Prevents JavaScript from accessing the cookie, mitigating XSS-based session theft (Correct answer)
- Causes the cookie to expire when the browser closes
- Limits the cookie to same-origin requests
Correct answer: Prevents JavaScript from accessing the cookie, mitigating XSS-based session theft
httpOnly cookies are inaccessible to document.cookie and JS APIs, so even a successful XSS attack cannot exfiltrate the session token.
Question 5: Which risk management strategy is applied when a Node.js team decides to replace a vulnerable cryptographic library with a maintained alternative?
- Risk acceptance
- Risk avoidance
- Risk transfer
- Risk remediation (mitigation) (Correct answer)
Correct answer: Risk remediation (mitigation)
Replacing a vulnerable component with a secure alternative directly reduces the likelihood and impact of the identified risk, which is remediation/mitigation.
Question 6: What Node.js-specific risk is introduced by caching HTTP responses that contain the Set-Cookie header at a shared CDN layer?
- Cookies fail to reach the client
- One user's session cookie is served to subsequent users, enabling session hijacking (Correct answer)
- TLS is bypassed for cached responses
- Cookie size limits are exceeded
Correct answer: One user's session cookie is served to subsequent users, enabling session hijacking
Caching a response with Set-Cookie shares that cookie value with every user who receives the cached copy, giving them another user's authenticated session.
Question 7: A Node.js application generates password reset tokens using Date.now(). What is the primary security risk?
- Tokens expire too quickly
- Tokens are predictable because timestamps are not random, enabling an attacker to guess valid tokens (Correct answer)
- Date.now() is not available in all Node.js versions
- Tokens are too long for email links
Correct answer: Tokens are predictable because timestamps are not random, enabling an attacker to guess valid tokens
Timestamp-based tokens have a small search space relative to a known approximate generation time, allowing brute-force prediction within seconds.
Node.js Risk Assessment & Management 5
What risk does calling child_process.exec() with shell interpolation of user data introduce compared to child_process.execFile()?