0

I start to working in a project here and find something that at least seems odd to me. Since I'm not an specialist I came here to ask.

It is a Java Web project that was made to run into a Tomcat server in an windows environment (Windows Server). The possible problem here is that inside the WEB-INF folder of that project there is a ssh folder with executable files like chmod.exe, chown.exe, ssh.exe and some cygwin DLLs.

Looking into the code I saw that there is some place calling those files to execute and run specific tasks.

My concern is about what that files can do because I known then, I've worked in project running into Linux systems.

So, would that (have such files with executable permissions), inside a tomcat server running in a windows machine be a potentially and dangerous security breach?

Improve this question
5
  • Maybe you just ask the one who setup the system first if this was intended?
    – Steffen Ullrich
    Jan 8, 2016 at 12:02
  • I already did, they explained why, it is understandable (though I think that it should be done right on the application code) but even though I would like to know if having such artifacts is problematic regarding security. @SteffenUllrich
    – Jorge Campos
    Jan 8, 2016 at 12:18
  • 2
    If it is intended like this it might be a security problem which might result in a breach if misused by an attacker, but it is not a breach by itself. It would be a breach if an attacker had installed it.
    – Steffen Ullrich
    Jan 8, 2016 at 12:49
  • @SteffenUllrich Hmmm, ok then. Is there something that I can read about it? Thank you for your time. I think that you can add it as an answer with some points explaining it (like why "it might be a security problem" with examples)! Thanks again.
    – Jorge Campos
    Jan 8, 2016 at 13:03
  • 1
    In broad terms , Yes , files with executable permissions, inside a tomcat server running in a windows machine be dangerous, because you are potentially increasing the attack surface.
    – Ijaz Ahmad
    Jan 8, 2016 at 13:41

1 Answer 1

Reset to default
2

Since according to the comment these files are intended this way this can not be considered a breach. A breach would only be if an attacker has installed the files there.

Of course these files might increase the attack surface because they might make it easier for a potential attacker. But this can probably also be said from other programs on the machine, like PowerShell or even the Java installation. It might also be that these files are installed in an insecure way (i.e. open remote access) but simple having SSH or any of the other tools on the machine is not a security problem by itself.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .