Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.

I don't how to restrict. I tried with file permissions, but when I remove read permissions the whole application stops working.

I googled and found that security constraints on servlet mapping can be used, but the developer says that is for weblogic. The java sys application is deployed on win 2008.

Are there other solutions?

share|improve this question
    
Why devs cant block it themselves? –  Andrew Smith Sep 1 '12 at 13:00
add comment

2 Answers

If you want to block web.xml without touching application, you can use modsecurity with IIS setup as reverse proxy server

share|improve this answer
add comment

Just put this in the .htaccess file:

Order Allow,Deny
Allow from all
<Files /web.xml>
    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1
</Files>

Let's run through this one line at a time:

  1. Order Allow,Deny - Allow all requests that don't match a htaccess rule.
  2. Allow from all - Allow all requests. We override this rule later with more specific rules.
  3. <Files /web.xml> - Apply the next set of rules to files that match /web.xml. This block overrides the rules set above.
  4. Order Deny,Allow - Deny all requests that don't match a htaccess rule within this block.
  5. Deny from all - Deny all requests. Again, we override this rule with a more specific one.
  6. Allow from 127.0.0.1 - Allow any request from 127.0.0.1 for /web.xml.
  7. </Files> - End the block we started on line 3.

Essentially, this leaves us with "for all files except web.xml, allow all requests. for web.xml, deny all requests unless they're from 127.0.0.1".

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.