Java Verb Tampering Via Misconfigured Security Constraint
Invicti detected that the web application is using a security-constraint section that includes a web-resource-collection section with one or more http-method definitions. It's not recommended to use http-method definitions. When listing specific methods in their configuration, developers are actually allowing more access than they intend. It's safer to remove all http-method definitions.
Example vulnerable config:
<security-constraint>
<web-resource-collection>
<web-resource-name>adminres</web-resource-name>
<url-pattern>/admin/*</url-pattern>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>
In the example above, an attacker can manipulate the HTTP method and use the HEAD method to access anything in the /admin/*.
Attackers can manipulate the HTTP method to attempt to bypass the security constraint.
Remove all http-method definitions from the security-constraint section.
Example safer config:
<security-constraint>
<web-resource-collection>
<web-resource-name>adminres</web-resource-name>
<url-pattern>/admin/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>
Select Category
Search Vulnerability
Related Vulnerabilities
