Hide web.xml file from public view

Question

I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.

I don't how to restrict. I tried with file permissions, but when I remove read permissions the whole application stops working.

I googled and found that security constraints on servlet mapping can be used, but the developer says that is for weblogic. The java sys application is deployed on win 2008.

Are there other solutions?

Answer 1

If you want to block web.xml without touching application, you can use modsecurity with IIS setup as reverse proxy server

Answer 2

Just put this in the .htaccess file:

Order Allow,Deny
Allow from all
<Files /web.xml>
    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1
</Files>

Let's run through this one line at a time:

1. Order Allow,Deny - Allow all requests that don't match a htaccess rule.
2. Allow from all - Allow all requests. We override this rule later with more specific rules.
3. <Files /web.xml> - Apply the next set of rules to files that match /web.xml. This block overrides the rules set above.
4. Order Deny,Allow - Deny all requests that don't match a htaccess rule within this block.
5. Deny from all - Deny all requests. Again, we override this rule with a more specific one.
6. Allow from 127.0.0.1 - Allow any request from 127.0.0.1 for /web.xml.
7. </Files> - End the block we started on line 3.

Essentially, this leaves us with "for all files except web.xml, allow all requests. for web.xml, deny all requests unless they're from 127.0.0.1".