Web.xml security misconfigurations

ID

java.web_xml_security_misconfigurations

Severity

high

Resource

Misconfiguration

Language

Java

Tags

CWE:1004, CWE:384, CWE:5, CWE:613, CWE:614, CWE:7, NIST.SP.800-53, OWASP:2021:A5, OWASP:2021:A7, PCI-DSS:6.5.6

Description

Web.xml security misconfigurations.

Rationale

The web.xml file is crucial for defining security configurations in Java web applications. Misconfigurations in this file can reveal sensitive information, compromise session security, and allow unauthorized access. The specific checks covered under this rule help enforce best practices and mitigate common security risks:

  • checkErrorPages: Ensures default error pages are configured to prevent exposure of sensitive server information through default error messages.

    Example Without Error Page Configuration:
[source, xml]
----
<!-- Misconfiguration leading to default server error messages -->
----
    Proper Error Page Configuration:
[source, xml]
----
<error-page>
    <error-code>404</error-code>
    <location>/error/404.html</location>
</error-page>
----

  • checkHttpOnly: Ensures the session cookie Http Only flag is set to prevent client-side scripts from accessing the session ID.

    Correct Configuration:
[source, xml]
----
<cookie-config>
    <http-only>true</http-only>
</cookie-config>
----

  • checkNoHttpMethodInSecurityConstraints: Ensures security constraints are not defined for specific HTTP methods to prevent bypass.

  • checkSecureSession: Ensures the session ID is marked as secure to protect session data during transmission over HTTPS.

    Secure Session Configuration:
[source, xml]
----
<cookie-config>
    <secure>true</secure>
</cookie-config>
----

  • checkSessionTimeout and checkSessionTimeoutExists: Ensures the session timeout is properly configured and exists to prevent sessions from remaining active indefinitely.

    Proper Session Timeout Configuration:
[source, xml]
----
<session-config>
    <session-timeout>30</session-timeout> <!-- 30 minutes -->
</session-config>
----

  • checkSessionIdInCookieOnly: Ensures the session ID is sent only in cookies, reducing session fixation and hijacking chances.

  • checkSSLForProtectedAreas: Ensures SSL is enforced for protected areas, requiring encrypted data transmission.

    Protecting Sensitive Areas with SSL:
[source, xml]
----
<security-constraint>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>
----

Remediation

To remediate web XML security misconfigurations, implement the following corrective measures to ensure robust security settings:

  1. Configure Custom Error Pages: Define custom error pages in the web.xml to prevent default server information leakage.

  2. Set Http Only for Cookies: Use the <cookie-config> configuration to set the Http Only flag to true, securing session cookies against client-side script access.

  3. Avoid HTTP Method-specific Security Constraints: Ensure security constraints apply uniformly without specifying HTTP methods to avoid unintended access protocols.

  4. Mark Session IDs as Secure: Configure session cookies with the secure attribute to ensure they are only transmitted over HTTPS.

  5. Define Session Timeout: Explicitly define a session timeout in web.xml to manage session lifespan effectively, and ensure the session-timeout element always exists.

  6. Restrict Session ID to Cookies Only: Ensure the session ID is transmitted solely through cookies rather than as URL parameters.

  7. Enforce SSL for Sensitive Areas: Implement SSL (HTTPS) for all protected resources by setting transport-guarantee to CONFIDENTIAL.

By adhering to these remediation guidelines, Java web applications can significantly enhance their security configuration and mitigate vulnerabilities associated with web.xml misconfigurations.

Configuration

The rule has the following configurable parameters:

  • checkErrorPages, enables the check that ensures that the default error pages were configured.

  • checkHttpOnly, enables the check that ensures that the session cookie Http Only flag will be set.

  • checkNoHttpMethodInSecurityConstraints, enables the check that ensures that the security constraints should not specify http methods.

  • checkSecureSession, enables the check that ensures that the session ID is configured as secure.

  • checkSessionTimeout, enables the check that ensures that the session timeout is properly configured.

  • checkSessionTimeoutExists, enables the check that ensures that the timeout element exists.

  • checkSessionIdInCookieOnly, enables the check that ensures that session ID is configured to be sent only in cookies.

  • checkSSLForProtectedAreas, enables the check that ensures that SSL must be set for protected areas.

References