0

I start to working in a project here and find something that at least seems odd to me. Since I'm not an specialist I came here to ask.

It is a Java Web project that was made to run into a Tomcat server in an windows environment (Windows Server). The possible problem here is that inside the WEB-INF folder of that project there is a ssh folder with executable files like chmod.exe, chown.exe, ssh.exe and some cygwin DLLs.

Looking into the code I saw that there is some place calling those files to execute and run specific tasks.

My concern is about what that files can do because I known then, I've worked in project running into Linux systems.

So, would that (have such files with executable permissions), inside a tomcat server running in a windows machine be a potentially and dangerous security breach?

  • Maybe you just ask the one who setup the system first if this was intended? – Steffen Ullrich Jan 8 '16 at 12:02
  • I already did, they explained why, it is understandable (though I think that it should be done right on the application code) but even though I would like to know if having such artifacts is problematic regarding security. @SteffenUllrich – Jorge Campos Jan 8 '16 at 12:18
  • 2
    If it is intended like this it might be a security problem which might result in a breach if misused by an attacker, but it is not a breach by itself. It would be a breach if an attacker had installed it. – Steffen Ullrich Jan 8 '16 at 12:49
  • @SteffenUllrich Hmmm, ok then. Is there something that I can read about it? Thank you for your time. I think that you can add it as an answer with some points explaining it (like why "it might be a security problem" with examples)! Thanks again. – Jorge Campos Jan 8 '16 at 13:03
  • 1
    In broad terms , Yes , files with executable permissions, inside a tomcat server running in a windows machine be dangerous, because you are potentially increasing the attack surface. – Ijaz Ahmad Khan Jan 8 '16 at 13:41
2

Since according to the comment these files are intended this way this can not be considered a breach. A breach would only be if an attacker has installed the files there.

Of course these files might increase the attack surface because they might make it easier for a potential attacker. But this can probably also be said from other programs on the machine, like PowerShell or even the Java installation. It might also be that these files are installed in an insecure way (i.e. open remote access) but simple having SSH or any of the other tools on the machine is not a security problem by itself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.