CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods
J2EE Misconfiguration: Weak Access Permissions for EJB Methods
Weakness ID: 9 (Weakness Variant)
Status: Draft
Description
Description Summary
If elevated access rights are assigned to EJB methods, then an attacker can take advantage of the permissions to exploit the software system.
Time of Introduction
Architecture and Design
Implementation
Common Consequences
Scope
Effect
Other
Technical Impact: Other
Demonstrative Examples
Example 1
The following deployment descriptor grants ANYONE permission to
invoke the Employee EJB's method named getSalary().
(Bad Code)
Example
Language: XML
<ejb-jar>
...
<assembly-descriptor>
<method-permission>
<role-name>ANYONE</role-name>
<method>
<ejb-name>Employee</ejb-name>
<method-name>getSalary</method-name>
</method-permission>
</assembly-descriptor>
...
</ejb-jar>
Potential Mitigations
Follow the principle of least privilege when assigning access rights
to EJB methods. Permission to invoke EJB methods should not be granted
to the ANYONE role.
Other Notes
If the EJB deployment descriptor contains one or more method permissions
that grant access to the special ANYONE role, it indicates that access
control for the application has not been fully thought through or that the
application is structured in such a way that reasonable access control
restrictions are impossible.
Description
