CWE-8 J2EE误配置：实体Bean远程声明

J2EE Misconfiguration: Entity Bean Declared Remote

结构: Simple

Abstraction: Variant

状态: Incomplete

被利用可能性: unkown

基本描述

When an application exposes a remote interface for an entity bean, it might also expose methods that get or set the bean's data. These methods could be leveraged to read sensitive information, or to change data in ways that violate the application's expectations, potentially leading to other vulnerabilities.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 668 cwe_View_ID: 1000 cwe_Ordinal: Primary

常见的影响

范围	影响	注释
['Confidentiality', 'Integrity']	['Read Application Data', 'Modify Application Data']

可能的缓解方案

Implementation

策略:

Declare Java beans "local" when possible. When a bean must be remotely accessible, make sure that sensitive information is not exposed, and ensure that the application logic performs appropriate validation of any data that might be modified by an attacker.

示例代码

例

The following example demonstrates the weakness.

bad XML

Notes

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
7 Pernicious Kingdoms			J2EE Misconfiguration: Unsafe Bean Declaration
Software Fault Patterns	SFP23		Exposed Data

文章来源于互联网:scap中文网