Reino: Environment

Esta sección incluye todo lo que está fuera del código fuente pero aun así es importante para la seguridad del producto que se está creando. Dado que todas las cuestiones incluidas en esta sección no están directamente relacionadas con el código fuente, las hemos separado de las demás secciones.

J2EE Misconfiguration: Missing Filter Definition

Java/JSP

Abstract

No se aplicarán las asignaciones de filtros que hagan referencia a un filtro inexistente.

Explanation

Cada asignación de filtros debe corresponder a una definición de filtro válida para que se aplique.

Ejemplo 1: En el siguiente ejemplo se muestra una asignación de filtros que hace referencia al filtro inexistente AuthenticationFilter. Como falta la definición, el filtro AuthenticationFilter no se aplicará al patrón de dirección URL designado /secure/* y puede causar una excepción en tiempo de ejecución.


<filter>
    <description>Compresses images to 64x64</description>
    <filter-name>ImageFilter</filter-name>
    <filter-class>com.ImageFilter</filter-class>
</filter>

<!-- AuthenticationFilter is not defined -->
<filter-mapping>
    <filter-name>AuthenticationFilter</filter-name>
    <url-pattern>/secure/*</url-pattern>
</filter-mapping>

<filter-mapping>
    <filter-name>ImageFilter</filter-name>
    <servlet-name>ImageServlet</servlet-name>
</filter-mapping>

References

[1] Sun Microsystems, Inc. Java Servlet Specification 2.4

[2] Standards Mapping - Common Weakness Enumeration CWE ID 284

[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094

[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1)

[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection

[6] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[7] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[8] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service

[9] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[10] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[11] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[12] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.9

[14] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II

[15] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II

[16] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II

[17] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II

[18] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II

[19] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II

[20] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II

[21] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II

[24] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002400 CAT II

[37] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)

[38] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service

desc.config.java.j2ee_misconfiguration_missing_filter_definition