Questions tagged [java]

Security aspects specific to the Java programming language, libraries, and virtual machine.

Filter by
Sorted by
Tagged with
-1
votes
0answers
32 views

Icon in a tray is not getting disappear after logging off the application [closed]

What to do if icon in a tray is not getting disappear after logging off the application.It is getting disappear on only mouse hover on that.
0
votes
1answer
42 views

Can Zap scan a web app launched as a JAVA applet?

I have a target which is a Java applet. When I reach the IP in the browser and enter credentials into a form, a .jnlp file downloads, which I need to double-click on to access the page. Does Zap have ...
0
votes
0answers
23 views

Getting security error on entering user id with trailing blank spaces [closed]

When a CSR attempts to login to ServiceConnectPro with an user id entered with trailing blank spaces, the CS Viewer application throw the Security Error. Application need to gracefully ignore the ...
0
votes
0answers
41 views

Is there a list of Unicode symbols that matches ASCII when lowercased (in java)?

Say we have a server-side code does a whitelist validation of allowed file extensions when user uploads a file: // Java code if (allowedExtensionsInLowercase.contains(fileExtension.toLowerCase())) { ...
0
votes
0answers
42 views

How to remediate a CVE or find a work around before the patch is released?

I was going through set of security vulnerabilities reported in Oracle Critical Patch Update. I want to find out the standard process followed by developers/security people to mitigate these kind of ...
0
votes
1answer
101 views

Is my Java code still vulnerable to SQL injection? [duplicate]

We have a Java web application that was vulnerable to blind SQL injection attacks. Our developers fixed the code by using the replaceAll() function to convert single quotes to two single quotes. I am ...
0
votes
0answers
18 views

Should XHTML template files for JSF be provided over the webserver?

Assume that I have a Java web application with JavaServer Faces (JSF) 2.x which uses XHTML files (so called Facelets) with the Java Expression language [1] In the current configuration, it is ...
1
vote
1answer
102 views

It this a safe way to filter input into an SQL query

Is this a safe way to filter strings into an SQL query in java or could this be bypassed? I understand that I should just parameterize everything but this is an ancient code base where it makes more ...
0
votes
0answers
30 views

How do I configure the Calculator web service sample code in netbeans to use x509 certificates for authentication? [migrated]

I have successfully followed the steps outlined here: https://netbeans.org/kb/docs/websvc/jax-ws.html Everything works correctly (i.e. I can run a client jar file from terminal and have it send two ...
0
votes
1answer
92 views

Some questions about encryption in Java

I have some questions about encryption in java as I'm trying to develop a password-manager-like application for my final test in Computer Science in High School (Germany). The password manager uses a ...
29
votes
6answers
7k views

Poor error handling source code review

I received a report from the security team today. The report contains the below mentioned vulnerabilities and descriptions: 1) Poor Error Handling: Overly Broad Throws The methods in program1....
0
votes
0answers
33 views

XXE inside an XML element? [closed]

I have a bug where a Java SAXReader with validation set to false reads XML I partially control. The reader gets supplied this: <event>[DATA I CONTROL]</event> I can put whatever I want ...
3
votes
2answers
174 views

Are ECB and CBC modes of operation generally insecure?

In some Java code that I'm reading, I stumbled over the following encryption algorithms passed to the Cipher.getInstance(...) method: AES/CBC/PKCS5Padding DESede/ECB/PKCS5Padding RSA/ECB/PKCS1Padding ...
0
votes
0answers
49 views

Check CRLs of signed JARs

I have a signed JAR. How could I check if the corresponding code-signing certificate was revoked? Technically there seem to be the following options: The Java TrustStore holds CRLs/revoked ...
2
votes
3answers
191 views

Would services or whole operating systems written in pure Python/Java be safer?

Many Windows and Linux services are written in C and/or C++. Due to that fact, they can be exploited in several ways due to the lack of memory security (buffer overflow, etc.). Are services written ...
1
vote
0answers
58 views

How do gadget chains work in relation to Java Deserialization attacks?

tl;dr I would love a detailed explanation how user-controlled input goes from readObject to RCE. Java-specific. The background This is my attempt to add specificity to the OP question as requested ...
2
votes
0answers
61 views

Is it safe to generate a temporary API key from a random generator seeded by a secure random generator?

I have a need to generate a key consisting of a given number of random characters that will be used to access resources via a public API. It should not be possible to predict the key. This is done in ...
0
votes
0answers
63 views

How is Hopwood's Java interface attack related to least common mechanism principle?

I'm trying to understand LCM and how David Hopwood's discovery is a noteworthy example of it. This site contains two important things. First, it identifies Hopwood's interface attack (1996) as an ...
1
vote
1answer
45 views

Best way to apply least privilege to one specific jar application on Linux

Let's say I have some java application running on the host and do different things, and now I have built a jar that captures network traffic. While reading What's a least-privilege way to allow node....
1
vote
1answer
71 views

Should I remove all non-FIPS providers from java.security to be FIPS-compliant?

I was tasked to implement FIPS certified providers in Java in our Docker images. We are going with Bouncy Castle's bc-fips. I see many providers listed in java.security: security.provider.1=SUN ...
1
vote
1answer
105 views

Bank client android app authentication security

I'm currently developing an android bank client app. Obviously security is key here. The app sends requests over HTTPS TLSv1.2 to my java server. What I currently have in mind Login The app asks ...
2
votes
0answers
57 views

Are there any JRE/JDK exploits that do not require the presence of applets or plugins?

For triggering a Java exploit should applets be enabled in the user's machine? That is, in a drive by download scenario, can just visiting a malicious URL trigger an exploit/cve on the user's pc due ...
0
votes
0answers
362 views

Implementation of Simple CSRF in Spring Boot and Angular 6 With Complete Solution

I am Implementing CSRF i.e Cross-Site Request Forgery in my project but not getting proper way to implement in my project and i am using Angular for FrontEnd and Java for BackEnd in Spring Boot and I ...
1
vote
0answers
97 views

Bypass prepared statements?

I know that prepared statements are used to handle input at the front end. However I was wondering how do you bypass a prepared statement? I have seen some people talk about string concentration but I’...
0
votes
2answers
92 views

Can I trust that the Java CVE's contain only the affected versions?

When looking at the Oracle Java JRE vulnerability list on cvedetails, they list the affected versions in the text, and usually also in a table below the description. However, I'm not confident that ...
1
vote
1answer
139 views

Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?

Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
2
votes
0answers
55 views

How to store a key for a Java app server?

Assume I have a Java app running on a Linux server. The app needs a secret key to do a task, such as decrypting or encrypting a file, after it starts up. This is a question about best practice for ...
0
votes
0answers
34 views

How to customize default enabled EC curves or the curves preference in Azul Zulu JDK

We use Zulu JDK and want to customize the default enabled EC curves. Oracle JRE provides this using jdk.tls.namedGroups system property in java.security. https://www.oracle.com/technetwork/java/...
1
vote
1answer
147 views

Avoid cross site scripting in XML namespace

We have a legacy application on spring mvc and we have a web service exposed (SOAP protocol) for some reporting client app. This service was tested by a security team and the report indicates that the ...
1
vote
1answer
168 views

Java Applet AccessControlException

I am doing a security course and a module on client side attacks, which is why this post might seem evil or outdated. I have a Java applet fetching a malicious jar file and trying to then download ...
0
votes
1answer
127 views

What is the following regex trying to protect against?

I am looking at a Java web application that compares all incoming request params and cookies against the following regex. If it matches, it is considered "an attack" and refuses the request. I'm ...
0
votes
1answer
395 views

ZAP Proxy unable to launch browser invalid argument: can't kill an exited process

Using OWSAP ZAP 2.8.0 On Ubuntu 19.04 With openjdk version 11.0.3 installed When clicking the "Launch Browser" button on ZAP to launch the HUD enabled browser for ZAP, no browser is launched and an ...
0
votes
1answer
185 views

Importing an expired certificate into my jks

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...
11
votes
4answers
4k views

What are the differences of checking a self-signed certificate vs ignore it?

I'm doing an integration with a system that has a self-signed certificate. For initial development, we choose to ignore the certificate checking to bypass some errors: Exception in thread "main" ...
0
votes
0answers
28 views

One JWT with different levels of permissions

I'm using JSON Web Token's to authenticate users. I have 2 types of tokens: 1/ basic token - no expiry, includes an embedded userAccessId(which is a guid) 2/ advanced token - expiry is 5 mins, ...
1
vote
1answer
261 views

Diffie–Hellman key exchange questions [closed]

at the moment I am working on a chat application, where more than two clients can communicate at the same time. I just got started with the encryption so please be bear with me. My goal is to ...
0
votes
1answer
105 views

Is it reasonably possible to enable vulnerabilities via gadget chains?

The meta question here is that I'm trying to understand the risks to multitenant java applications from gadget chains. For example, we're all familiar with the deserialization gadget that allows the ...
0
votes
0answers
148 views

Generating a valid payload for RichFaces 3.X

I am currently running on a virtual machine JBoss 5.1.0GA + RichFaces 3.X + photoalbum demo which makes me vulnerable (only accessible from my LAN) to CVE-2018-14667. I have tested the payload ...
1
vote
1answer
167 views

Is it Possible to Prevent a Physcial Attack on Server in Remote Data Center?

I've been using Amazon Web Services to run my Java application. However, due to high costs I'm looking into getting a dedicated server from Hetzner, a company based in Germany, which costs about 10-...
0
votes
1answer
138 views

Are old, unused Java SE JRE files insecure?

We have an agent application deployed to some internal web servers that runs on java, and installs a specific JRE to use. The agent updates regularly and installs updated JRE versions to use, but ...
0
votes
1answer
284 views

How to ensure same BCrypt hash on different platforms?

Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android) and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and ...
4
votes
1answer
123 views

how much is AES GCM's security affected when not using unique IV's

I've read some articles and tutorials about AES GCM and was using this cipher for one of my java-projects, so let's say I know some basics. I read that you should use an IV-length of 12 bytes which ...
0
votes
0answers
44 views

Store secret for HS256 (JWT) in repository?

For JWT generation in my Java application I need to use the secret. Thus, I need to include this along with other source code into repository, which is a no-no. So how can I store the secret in ...
1
vote
1answer
374 views

How to get access token programatically when we try to authorize by grand_type auth-code in the OAuth 2.0 like a user?

There is a bank service that provides API to do some operations with bank accounts. To perform a request to all endpoints of this service I, first of all, need to get auth token via grand_type=...
2
votes
2answers
336 views

Security Benefits of Reverse Proxying Java / Tomcat WebApps Locally

Conventional wisdom seems to dictate that java applications should always be reverse proxied. It's what I have always done and so has everywhere I have worked at. I have read multiple times that ...
0
votes
0answers
56 views

Does upgrading the JVM version resolve security issues, even if I'm using an older language version?

Hypothetically, let's presume Java version X (an old version) has a known security vulnerability. If I've been using this version of Java, and say hosting webservers with that version, it's "unsafe". (...
0
votes
1answer
503 views

What is the process of finding deep links from an Android application?

I'm very curious on how to go about this the only solution i can think of is to decompile, modify the code to print when a deep link is clicked, and recompile, if you have any other suggestions i ...
2
votes
0answers
260 views

Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?

I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
0
votes
1answer
260 views

Storing vault read token securely

I have PCF spring boot application which needs to access the vault server to get the credentials to create datasource during startup. Right now we are hard coding the app role id and secret id in the ...
1
vote
2answers
215 views

Text field exploit

If a web application form contain few textbox fields. Among one should accept only 4 digit according to business logic. But it's taking more than 4 digit values. Is there any potential vulnerability ...

1 2 3 4 5 13