Reino: Environment

Esta sección incluye todo lo que está fuera del código fuente pero aun así es importante para la seguridad del producto que se está creando. Dado que todas las cuestiones incluidas en esta sección no están directamente relacionadas con el código fuente, las hemos separado de las demás secciones.

J2EE Misconfiguration: Missing Servlet Mapping

Java/JSP

Abstract

No se puede acceder a un servlet definido en web.xml sin una asignación de servlets correspondiente.

Explanation

La ausencia de una asignación de servlets válida impide todo acceso al servlet sin asignar.

Ejemplo 1: La siguiente entrada de web.xml define ExampleServlet pero no puede definir una asignación de servlets correspondiente.


<web-app
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
    version="2.4">

    <servlet>
      <servlet-name>ExampleServlet</servlet-name>
      <servlet-class>com.class.ExampleServlet</servlet-class>
      <load-on-startup>1</load-on-startup>
    </servlet>

</web-app>

References

[1] Sun Microsystems, Inc. Java Servlet Specification 2.4

[2] Standards Mapping - Common Weakness Enumeration CWE ID 684

[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094

[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1)

[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection

[6] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[7] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[8] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service

[9] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[10] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[11] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[12] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.9

[14] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II

[15] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II

[16] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II

[17] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II

[18] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II

[19] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II

[20] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II

[21] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II

[24] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002400 CAT II

[37] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)

[38] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service

desc.config.java.j2ee_misconfiguration_missing_servlet_mapping