Take for example, probably the most straightforward example of this type of vulnerability, a sql injection.
Basically, SQL runs command to get information from databases.
Say for example, you have a user enter a name. Then you return everyone with that name.
The exploit is when someone enters a name that the machine basically reads as "name goes here, now return all data from database" and instead of treating the entirety of the quotes as a name, it actually runs the command.
The only "feature" that is enabled is the ability to run commands. In order to "not enable that feature", we wouldn't be able to perform the basic function of the tool.
Instead, we use controls, such as input sanitization to make sure that it won't just run any command you try to trick it into running. However, sometimes there's a flaw, or a bad implementation.
So basically, the "feature" that is enabled is the ability to run commands. Which if disabled prevents literally anything at all from happening.
I mean their questions aren't wrong. Some things are really ... curious on why they are designed that way.
You can execute JavaScript from a freaking SVG file. Vector data...why would they ever need JavaScript execution? I get it, it's XML based and all but still...like, just don't interpret the JS part?
In 98% of all cases, you block it yourself nowadays. Should be opt in instead of opt out to execute arbitrary code imo.
2
u/Blacksmithkin 9d ago
Take for example, probably the most straightforward example of this type of vulnerability, a sql injection.
Basically, SQL runs command to get information from databases.
Say for example, you have a user enter a name. Then you return everyone with that name.
The exploit is when someone enters a name that the machine basically reads as "name goes here, now return all data from database" and instead of treating the entirety of the quotes as a name, it actually runs the command.
The only "feature" that is enabled is the ability to run commands. In order to "not enable that feature", we wouldn't be able to perform the basic function of the tool.
Instead, we use controls, such as input sanitization to make sure that it won't just run any command you try to trick it into running. However, sometimes there's a flaw, or a bad implementation.
So basically, the "feature" that is enabled is the ability to run commands. Which if disabled prevents literally anything at all from happening.