CERT Advisory CA-2000-02

CERT Advisory CA-2000-02 (Malicious Scripting Tags Embedded in Client Web Requests) discusses how malicious scripts can be introduced into dynamically generated web pages based on unvalidated input from untrustworthy sources (typically web browsers). Most of the advisory addresses issues concerning browsers and web site developers. The portion of the advisory that concerns web servers has to do with dynamically generated pages that the web server may install by default.

Java Web Server ships with some example servlets and CGI scripts that dynamically generate content and could potentially be exploited because they echo portions of the URL that invoked them back to the browser. The core functionality of Java Web Server is secure -- it is only the examples that need to be addressed.

While only a couple of the examples could be exploited we have always recommended that all examples and unnecessary servlets be disabled before deploying Java Web Server into a production environment. This not only addresses the recent CERT advisory, but also makes Java Web Server more secure and efficient in general. We reiterate that recommendation here.

Removing Examples and Unnecessary Servlets

Java Web Server 2.0:

1. Remove CGI examples.

   In the file system, remove:

   server_root/cgi-bin/nph-test-cgi.pl
                       redirect.pl
                       test-cgi.pl
   
   

   Where server_root is the installation directory of Java Web Server.

2. If you are not using CGI, you may disable the CGI servlet as well.

   In the Java Web Server administration applet remove the following servlet alias:

   	/cgi-bin        cgi
   

   Do this for both the "Web Service" and the "Secure Web Service" if you are running both.

3. De-configure example web pages.

   In the Java Web Server administration applet (under "Setup"), remove the following File Alias:

   
   	/examples       $server_home/examples
   

   Do this for both the "Web Service" and the "Secure Web Service" if you are running both.

4. De-configure example servlets.

   In the Java Web Server administration applet (under "Setup"), remove the following Servlet Aliases:

   
   	/counter.html   counter
   	/date.txt       dateservlet
   	/phone.html     phone
   	/pservlet       pservlet
   	/session.html   session
   	/snoop.html     snoop
   

   Under "Servlets" remove the following:

   	counter
   	dateservlet
   	linkcheck
   	phone
   	pservlet
   	session
   	simpleformservlet
   	simpleservlet
   	snoop
   

   Do this for both the "Web Service" and the "Secure Web Service" if you are running both.

5. Disable the Invoker Servlet.

   In a deployment environment you should not use the Invoker Servlet to run servlets. Instead you should place your servlet classes in Java Web Server's CLASSPATH and use a servlet alias to invoke them. server_root/classes is in Java Web Server's CLASSPATH and contains a README with more information.

   To disable the invoker servlet, remove the following Servlet Alias

   	/servlet    invoker
   

   Do this for both the "Web Service" and the "Secure Web Service" if you are running both.

   As a further precaution you may wish to remove the servlet class files accessed using the invoker servlet. Specifically remove the directory server_root/servlets. You may want to back this up to another location first. Note that server_root/servlets/sunexamples contains the majority of the example servlets.

6. Change your document root to something other than the default (in admin applet under "Setup Site").

Java Web Server 1.1.3

1. Perform steps 1,2,4,5,6 above.

2. De-configure additional example servlets.

In the Java Web Server administration applet (under "Setup"), remove the following Servlet Aliases:

                /ca/servlet      CA
                /loganalyzer     loganalyzer
                /sessionSSL.html sessionSSL

Under "Servlets" remove the following:

		certAuthority
		loganalyzer
		sessionSSL

For More Information