I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.

I don't how to restrict. I tried with file permissions, but when I remove read permissions the whole application stops working.

I googled and found that security constraints on servlet mapping can be used, but the developer says that is for weblogic. The java sys application is deployed on win 2008.

Are there other solutions?

  • Why devs cant block it themselves? – Andrew Smith Sep 1 '12 at 13:00

Just put this in the .htaccess file:

Order Allow,Deny
Allow from all
<Files /web.xml>
    Order Deny,Allow
    Deny from all
    Allow from

Let's run through this one line at a time:

  1. Order Allow,Deny - Allow all requests that don't match a htaccess rule.
  2. Allow from all - Allow all requests. We override this rule later with more specific rules.
  3. <Files /web.xml> - Apply the next set of rules to files that match /web.xml. This block overrides the rules set above.
  4. Order Deny,Allow - Deny all requests that don't match a htaccess rule within this block.
  5. Deny from all - Deny all requests. Again, we override this rule with a more specific one.
  6. Allow from - Allow any request from for /web.xml.
  7. </Files> - End the block we started on line 3.

Essentially, this leaves us with "for all files except web.xml, allow all requests. for web.xml, deny all requests unless they're from".

| improve this answer | |

If you want to block web.xml without touching application, you can use modsecurity with IIS setup as reverse proxy server

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.