I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.

I don't how to restrict. I tried with file permissions, but when I remove read permissions the whole application stops working.

I googled and found that security constraints on servlet mapping can be used, but the developer says that is for weblogic. The java sys application is deployed on win 2008.

Are there other solutions?

  • Why devs cant block it themselves? Commented Sep 1, 2012 at 13:00

2 Answers 2


Just put this in the .htaccess file:

Order Allow,Deny
Allow from all
<Files /web.xml>
    Order Deny,Allow
    Deny from all
    Allow from

Let's run through this one line at a time:

  1. Order Allow,Deny - Allow all requests that don't match a htaccess rule.
  2. Allow from all - Allow all requests. We override this rule later with more specific rules.
  3. <Files /web.xml> - Apply the next set of rules to files that match /web.xml. This block overrides the rules set above.
  4. Order Deny,Allow - Deny all requests that don't match a htaccess rule within this block.
  5. Deny from all - Deny all requests. Again, we override this rule with a more specific one.
  6. Allow from - Allow any request from for /web.xml.
  7. </Files> - End the block we started on line 3.

Essentially, this leaves us with "for all files except web.xml, allow all requests. for web.xml, deny all requests unless they're from".


If you want to block web.xml without touching application, you can use modsecurity with IIS setup as reverse proxy server

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .