SecurityX (CASP+) labs
Every hands-on lab that maps to the CompTIA SecurityX (CASP+) (CAS-005) certification. This is the full lab package for that certification.
Certification: CompTIA › SecurityX (CASP+) CAS-005 clear · browse all certifications
38 labs
Expert
Root-Cause & Secure Configuration: CVE-2026-42945
Analyze CVE-2026-42945 at the source: understand the NGINX rewrite-module buffer-size miscalculation (CWE-131/122) and the upstream fix, reject a config change that only relocates the trigger, deploy a named-capture config, upgrade, add a WAF control, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: Authentication
Fix Authentication Weakness (brute force) (CWE-307) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: Broken Access Control
Fix Broken Access Control (IDOR) (CWE-639) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: Command Injection
Fix Command Injection (CWE-78) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CSRF
Fix Cross-Site Request Forgery (CSRF) (CWE-352) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2023-27350
Fix CVE-2023-27350 at the source. Read the vulnerable PaperCut NG/MF code, see how an unauthenticated request reached the admin console and ran a device script as SYSTEM (CWE-284 Improper Access Control), reject a denylist, require an authenticated admin session for every admin page, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2023-34960
Fix CVE-2023-34960 at the source. Read the vulnerable Chamilo LMS code, see how a crafted file name in a SOAP call was passed to a shell (CWE-78 OS Command Injection), reject a denylist, run the converter with an argument vector (no shell) and validate the file name, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2023-38646
Fix CVE-2023-38646 at the source. Read the vulnerable Metabase code, see how an H2 JDBC connection string executed code at connect time, pre-auth (CWE-94 Code Injection), reject a denylist, require auth, reject user H2 connections and build the URL from a property allowlist, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2023-43208
Fix CVE-2023-43208 at the source. Read the vulnerable NextGen Healthcare Mirth Connect code, see how an unauthenticated XML body was deserialized into a gadget chain and ran code (CWE-502 Deserialization of Untrusted Data), reject a denylist, require auth and lock XStream to an allowlist of expected types, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-2044
Fix CVE-2024-2044 at the source. Read the vulnerable pgAdmin 4 session loader, see how the id builds the path (CWE-31) and pickle.load runs code, reject a dot-stripping attempt, validate/canonicalize the path and use json instead of pickle, record session hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-23897
Fix CVE-2024-23897 at the source. Read the vulnerable Jenkins CLI parser, see how the args4j '@' file-expansion feature is left enabled (CWE-27 arbitrary file read), reject a path denylist, disable the feature with setExpandAtFiles(false), record CLI hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-27348
Fix CVE-2024-27348 at the source. Read the vulnerable Apache HugeGraph-Server code, see how a Gremlin query bypassed the sandbox via reflection and ran OS commands (CWE-77 Command Injection), reject a denylist, deny reflection and OS execution in the sandbox (allowlist of safe classes), record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-3400
Fix CVE-2024-3400 at the source. Read the vulnerable PAN-OS GlobalProtect telemetry helper, see how it passes the SESSID value into a shell command run as root (CWE-77), reject a metacharacter denylist, run the helper with an argument vector (execve, no shell) with input validation, restrict exposure, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-36401
Fix CVE-2024-36401 at the source. Read the vulnerable GeoServer code, see how a request property name was evaluated as an expression and ran code (CWE-94 Code Injection), reject a denylist, stop evaluating names as expressions and look them up as literal attributes, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-29927
Fix CVE-2025-29927 at the source. Read the vulnerable Next.js request pipeline, see how it skips middleware based on the client x-middleware-subrequest header (CWE-285), reject a known-value comparison, derive the skip decision from an internal server-set signal and strip the header at the edge, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-31131
Fix CVE-2025-31131 at the source. Read the vulnerable YesWiki template loader, see how the squelette value is concatenated into the file path (CWE-22), reject a dot-stripping attempt, deploy a validated loader (basename + extension allowlist + realpath), add a WAF rule, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-32463
Fix CVE-2025-32463 at the source. Read the vulnerable sudo chroot setup, see how it loads nsswitch.conf from the user-supplied chroot dir while privileged (CWE-829), reject a world-writable check, load config from the trusted real root instead, retire the deprecated chroot feature in sudoers, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-3248
Fix CVE-2025-3248 at the source. Read the vulnerable Langflow /api/v1/validate/code endpoint, see how it has no auth and execs posted code (CWE-306 + code injection), reject a name denylist, require authentication and validate by ast.parse instead of exec, restrict the service, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-49113
Fix CVE-2025-49113 at the source. Read the vulnerable Roundcube Webmail upload.php handler, see how it unserializes the _from value (CWE-502 object injection), reject a string blacklist, validate _from as an identifier instead of unserializing, harden PHP, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-55182
Fix CVE-2025-55182 at the source. Read the vulnerable React Server Components server-action handler, see how it resolves the action reference from the deserialized payload (CWE-502), reject a string denylist, deploy an allowlist/registry lookup with strict decoding, enforce an origin/CSRF check, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-68613
Fix CVE-2025-68613 at the source. Read the vulnerable n8n expression evaluator, see how it compiles user expressions with new Function so require()/process reach the server runtime (CWE-913), reject a string denylist, deploy an isolated-vm sandbox with no Node globals, harden the runtime (restricted editing + least privilege), and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-10520
Fix CVE-2026-10520 at the source. Read the vulnerable Ivanti Sentry report helper, see how it passes the host value into a shell command run as root (CWE-78), reject a metacharacter denylist, run the program with an argument vector (execve, no shell) with input validation, restrict the management interface, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-1357
Fix CVE-2026-1357 at the source. Read the vulnerable WPvivid upload handler, see how the request filename is concatenated into the destination path (CWE-434), reject a dot-stripping attempt, deploy a validated handler (basename + extension allowlist + realpath), deny PHP execution in uploads so an upload cannot reach RCE, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-2329
Fix CVE-2026-2329 at the source. Read the vulnerable Grandstream CGI handler, trace the unauthenticated request parameter to the unbounded copy (CWE-121), reject a strncpy attempt that still overflows, deploy the bounds-checked fix, add a management-VLAN compensating control, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-29058
Fix CVE-2026-29058 at the source. Read the vulnerable AVideo encoder code, trace untrusted input from the request parameter to the OS-command sink, reject a tempting but insufficient blacklist/escapeshellcmd fix, then deploy and prove the correct remediation: allow-list validation plus shell-free execution. Audit and re-scan to verify, and write the pull request.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-42167
Fix CVE-2026-42167 at the source. Read the vulnerable ProFTPD mod_sql handler, see how the username is formatted into the SQL (CWE-89), reject a quote-escaping attempt, deploy a parameterized query, restrict the database role so injection cannot reach RCE, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-48282
Fix CVE-2026-48282 at the source. Read the vulnerable Adobe ColdFusion template-include handler, see how the tpl value is concatenated into the include path (CWE-22) and executed, reject a dot-stripping attempt, deploy a validated handler (getFileFromPath + allowlist + getCanonicalPath), record the lockdown and upload deny-exec, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-72898
Fix CVE-2026-72898 at the source. Read the vulnerable Metabase /reset_password handler, see how it concatenates the email into SQL (CWE-89), reject a quote-stripping attempt, deploy a parameterized query, restrict the app DB role to least privilege, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: File Inclusion
Fix File Inclusion (LFI/RFI) (CWE-98) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: File Upload
Fix Unrestricted File Upload (CWE-434) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: SQL Injection
Fix SQL Injection (CWE-89) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: SSRF
Fix Server-Side Request Forgery (CWE-918) at the source. Read the vulnerable URL-fetch handler, see how it fetches any user URL and follows redirects, reject a substring blocklist, and apply the real fix: allowlist the host, resolve it and reject loopback/link-local/private IPs, and disable redirects. Record IMDSv2 + egress hardening and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: SSTI
Fix Server-Side Template Injection (SSTI) (CWE-1336) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: XSS
Fix Cross-Site Scripting (XSS) (CWE-79) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: XXE
Fix XML External Entity (XXE) (CWE-611) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Configuration: CVE-2025-24813
Fix CVE-2025-24813 at the deployment. Understand the partial-PUT path-equivalence parsing flaw (CWE-44) and how FileStore session deserialization (CWE-502) turns it into RCE, reject a .jsp extension blacklist, deploy a hardened config (read-only Default Servlet, partial PUT disabled, no FileStore) alongside the upgrade, and verify with audit and vulnscan.
Expert
Root-Cause Analysis & Kernel Hardening: CVE-2026-31431
Analyze CVE-2026-31431 at the source: understand the CWE-669 cross-sphere flaw in the kernel's AF_ALG AEAD interface and the out-of-place upstream fix, then patch and apply defense-in-depth hardening (module blacklist, restricted user namespaces) and verify the posture.
Expert
Root-Cause Analysis & Kernel Hardening: CVE-2026-43284 & CVE-2026-43500
Analyze two related Linux kernel CVEs (CVE-2026-43284 and CVE-2026-43500) at the source: recognize the shared root cause (in-place decryption over shared socket-buffer fragments) across IPsec/ESP and RxRPC, read both upstream fixes, then patch both with one update and apply defense-in-depth hardening for both subsystems, and verify.