the-web-application-hackers-handbook

716 Chapter 19 n Finding Vulnerabilities in Source Code
Often, in this type of situation, the application is vulnerable to something
other than code execution. For example, if an application executes the program
wget with a user-controllable parameter as the target URL, an attacker may
be able to pass dangerous command-line arguments to the wget process. For
example, the attacker might cause wget to download a document and save it to
an arbitrary location in the filesystem.
URL Redirection
The following APIs can be used to issue an HTTP redirect in Java:
n javax.servlet.http.HttpServletResponse.sendRedirect
n javax.servlet.http.HttpServletResponse.setStatus
n javax.servlet.http.HttpServletResponse.addHeader
The usual means of causing a redirect response is via the sendRedirect
method, which takes a string containing a relative or absolute URL. If the value
of this string is user-controllable, the application is probably vulnerable to a
phishing vector.
You should also be sure to review any uses of the setStatus and addHeader
APIs. Given that a redirect simply involves a 3xx response containing an HTTP
Location header, an application may implement redirects using these APIs.
Sockets
The java.net.Socket class takes various forms of target host and port details
in its constructors. If the parameters passed are user-controllable in any way,
the application may be exploitable to cause network connections to arbitrary
hosts, either on the Internet or on the private DMZ or internal network on which
the application is hosted.
Configuring the Java Environment
The web.xml file contains configuration settings for the Java Platform environment
and controls how applications behave. If an application is using container-managed
security, authentication and authorization are declared in web.xml against
each resource or collection of resources to be secured, outside the application
code. Table 19-3 shows configuration options that may be set in the web.xml file.
Servlets can enforce programmatic checks with HttpServletRequest.isUserInRole
to access the same role information from within the servlet code. A