Skip to content

Commit 791f31f

Browse files
aschackmullaschackmull
authored
Merge pull request github#3595 from luchua-bc/j2ee-server-directory-listing
Java: Add check for J2EE server directory listing
2 parents daeb13d + fffc88e commit 791f31f

File tree

6 files changed

+128
-0
lines changed

6 files changed

+128
-0
lines changed

‎java/ql/src/experimental/Security/CWE/CWE-548/InsecureDirectoryConfig.qhelp

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
2+
<qhelp>
3+
4+
<overview>
5+
<p>Enabling directory listing in J2EE application servers introduces the vulnerability of filename and path disclosure, which could allow an attacker to read arbitrary files in the server web directory. This includes application source code and data, as well as credentials for back-end systems.</p>
6+
<p>The query detects insecure configuration by validating its web configuration.</p>
7+
</overview>
8+
9+
<recommendation>
10+
<p>Always disabling directory listing in the production environment.</p>
11+
</recommendation>
12+
13+
<example>
14+
<p>The following two examples show two ways of directory listing configuration. In the 'BAD' case, it is enabled. In the 'GOOD' case, it is disabled.</p>
15+
<sample src="web.xml" />
16+
</example>
17+
18+
<references>
19+
<li>
20+
<a href="https://cwe.mitre.org/data/definitions/548.html">CWE-548: Exposure of Information Through Directory Listing</a>
21+
<a href="https://portswigger.net/kb/issues/00600100_directory-listing">Directory listing</a>
22+
<a href="https://portswigger.net/web-security/file-path-traversal">Directory traversal</a>
23+
</li>
24+
</references>
25+
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-548/InsecureDirectoryConfig.ql

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
/**
2+
* @name Directories and files exposure
3+
* @description A directory listing provides an attacker with the complete index of all the resources located inside of the complete web directory, which could yield files containing sensitive information like source code and credentials to the attacker.
4+
* @kind problem
5+
* @id java/server-directory-listing
6+
* @tags security
7+
* external/cwe-548
8+
*/
9+
10+
import java
11+
import semmle.code.xml.WebXML
12+
13+
/**
14+
* The default `<servlet-class>` element in a `web.xml` file.
15+
*/
16+
private class DefaultTomcatServlet extends WebServletClass {
17+
DefaultTomcatServlet() {
18+
this.getTextValue() = "org.apache.catalina.servlets.DefaultServlet" //Default servlet of Tomcat and other servlet containers derived from Tomcat like Glassfish
19+
}
20+
}
21+
22+
/**
23+
* The `<init-param>` element in a `web.xml` file, nested under a `<servlet>` element controlling directory listing.
24+
*/
25+
class DirectoryListingInitParam extends WebXMLElement {
26+
DirectoryListingInitParam() {
27+
getName() = "init-param" and
28+
getAChild("param-name").getTextValue() = "listings" and
29+
exists(WebServlet servlet |
30+
getParent() = servlet and servlet.getAChild("servlet-class") instanceof DefaultTomcatServlet
31+
)
32+
}
33+
34+
/**
35+
* Check the `<param-value>` element (true - enabled, false - disabled)
36+
*/
37+
predicate isListingEnabled() { getAChild("param-value").getTextValue().toLowerCase() = "true" }
38+
}
39+
40+
from DirectoryListingInitParam initp
41+
where initp.isListingEnabled()
42+
select initp, "Directory listing should be disabled to mitigate filename and path disclosure"

‎java/ql/src/experimental/Security/CWE/CWE-548/web.xml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<?xml version="1.0" encoding="UTF-8" ?>
2+
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
3+
http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd" version="4.0">
4+
5+
<!-- The default servlet for all web applications, that serves static -->
6+
<!-- resources. It processes all requests that are not mapped to other -->
7+
<!-- servlets with servlet mappings (defined either here or in your own -->
8+
<!-- web.xml file). -->
9+
<servlet>
10+
<servlet-name>default</servlet-name>
11+
<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
12+
<init-param>
13+
<param-name>listings</param-name>
14+
<!-- GOOD: Don't allow directory listing -->
15+
<param-value>false</param-value>
16+
</init-param>
17+
<load-on-startup>1</load-on-startup>
18+
</servlet>
19+
20+
<servlet>
21+
<servlet-name>default</servlet-name>
22+
<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
23+
<init-param>
24+
<param-name>listings</param-name>
25+
<!-- BAD: Allow directory listing -->
26+
<param-value>true</param-value>
27+
</init-param>
28+
<load-on-startup>1</load-on-startup>
29+
</servlet>
30+
</web-app>

‎java/ql/test/experimental/query-tests/security/CWE-548/InsecureDirectoryConfig.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| insecure-web.xml:16:9:19:22 | init-param | Directory listing should be disabled to mitigate filename and path disclosure |

‎java/ql/test/experimental/query-tests/security/CWE-548/InsecureDirectoryConfig.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security/CWE/CWE-548/InsecureDirectoryConfig.ql

‎java/ql/test/experimental/query-tests/security/CWE-548/insecure-web.xml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<?xml version="1.0" encoding="UTF-8" ?>
2+
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
3+
http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd" version="4.0">
4+
5+
<!-- The default servlet for all web applications, that serves static -->
6+
<!-- resources. It processes all requests that are not mapped to other -->
7+
<!-- servlets with servlet mappings (defined either here or in your own -->
8+
<!-- web.xml file). -->
9+
<servlet>
10+
<servlet-name>default</servlet-name>
11+
<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
12+
<init-param>
13+
<param-name>debug</param-name>
14+
<param-value>0</param-value>
15+
</init-param>
16+
<init-param>
17+
<param-name>listings</param-name>
18+
<param-value>true</param-value>
19+
</init-param>
20+
<load-on-startup>1</load-on-startup>
21+
</servlet>
22+
23+
<!-- The mapping for the default servlet -->
24+
<servlet-mapping>
25+
<servlet-name>default</servlet-name>
26+
<url-pattern>/</url-pattern>
27+
</servlet-mapping>
28+
29+
</web-app>

0 commit comments

Comments
 (0)