I start to working in a project here and find something that at least seems odd to me. Since I'm not an specialist I came here to ask.
It is a Java Web project that was made to run into a Tomcat server in an windows environment (Windows Server). The possible problem here is that inside the WEB-INF
folder of that project there is a ssh folder with executable files like chmod.exe, chown.exe, ssh.exe
and some cygwin
DLLs.
Looking into the code I saw that there is some place calling those files to execute and run specific tasks.
My concern is about what that files can do because I known then, I've worked in project running into Linux systems.
So, would that (have such files with executable permissions), inside a tomcat server running in a windows machine be a potentially and dangerous security breach?