CEH Web Application and Injection Attacks Practice Question
A web application has an endpoint that takes a URL parameter and fetches content from that URL, returning it to the user. An attacker supplies 'file:///etc/passwd' and reads the server's passwd file. Which vulnerability is this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-Side Request Forgery (SSRF)
This is SSRF because the server is making requests to internal resources based on user input; file:// is a protocol that can be used for local file access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Command injection
Why it's wrong here
Command injection occurs when an attacker injects operating system commands into an application input that is then executed by the underlying system. While a URL parameter is an input, the vulnerability described (fetching a URL via file:// protocol) is about the server making an HTTP/network request to an internal resource, not directly executing a shell command. The core difference lies in the interpreter targeted: a shell for command injection versus a URL fetching library for Server-Side Request Forgery (SSRF).
- ✗
Remote File Inclusion (RFI)
Why it's wrong here
Remote File Inclusion (RFI) vulnerabilities allow an attacker to include and execute arbitrary remote files, typically scripts, on the server. This often involves functions like include() or require() in PHP. While it involves remote resources, the primary objective and mechanism of RFI are to achieve code execution on the server by loading malicious scripts, whereas the scenario described focuses on the server being coerced into making an outbound request to internal resources, not necessarily executing them as code.
- ✓
Server-Side Request Forgery (SSRF)
Why this is correct
Server-Side Request Forgery (SSRF) occurs when a web application is coerced into making an HTTP request to an arbitrary URL specified by an attacker. This vulnerability allows an attacker to force the server to connect to internal or external systems, often bypassing firewalls or accessing sensitive internal services. The use of the file:// protocol in the URL parameter is a classic indicator, enabling the server to fetch local files from its own filesystem, effectively turning the server into a proxy for accessing internal resources.
- ✗
Directory traversal
Why it's wrong here
Directory traversal, also known as path traversal, allows an attacker to read arbitrary files on the server by manipulating file paths. This is typically achieved by using sequences like ../ to navigate outside of an intended directory. While it aims to access local files, its mechanism is path manipulation within a file system access function, not by tricking the server into initiating a network-like request to a file:// URL, which is the defining characteristic of SSRF.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.