Skip to main content

Automatic information enumeration - Open ports

Need​

Restriction of open ports to only necessary and authorized services

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance improvements.
  • Usage of javax.servlet-api for building Java web applications with servlets

Description​

Non compliant code​

import java.io.IOException;
import java.net.ServerSocket;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;

public class OpenPortsServlet extends HttpServlet {

    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        for (int port = 1; port <= 65535; port++) {
            try {
                ServerSocket server = new ServerSocket(port);
                server.close();
            } catch (IOException e) {
                // The port is open. Do something...
            }
        }
    }
}

The above code is a simple servlet that attempts to open a ServerSocket on every port number from 1 through 65535, which is the full range of valid port numbers. When it fails to open a socket, it catches the IOException and does nothing, effectively ignoring the error. This is a clear example of automatic information enumeration, specifically, open port scanning.

In this scenario, the servlet is essentially running a port scan on its own host machine. By attempting to open a server socket on every port, it's able to determine which ports are open (i.e., which ports it fails to open a socket on).

This vulnerability is dangerous because it exposes a lot of information about the host machine to potential attackers. By knowing which ports are open, an attacker can infer what services might be running on those ports, and use this information to plan their attack. Furthermore, by opening and closing so many sockets in such a short amount of time, this code could potentially exhaust the host machine's resources, leading to a denial-of-service condition.

Moreover, the information about open ports can be easily enumerated and consumed by an attacker as the exception is caught and no action is taken, making the application more vulnerable to attacks.

Steps​

  • Limit the range of ports that are being scanned. Instead of scanning all ports from 1 to 65535, specify a smaller range of ports that are necessary for your application.
  • Implement proper input validation and sanitization to ensure that only valid and expected input is processed.
  • Consider implementing rate limiting or throttling mechanisms to prevent excessive scanning or enumeration attempts.
  • Regularly review and update the security group configuration to ensure that only necessary ports are open.
  • Implement network monitoring and intrusion detection systems to detect and respond to any unauthorized scanning or enumeration attempts.
  • Consider implementing additional security measures such as firewall rules, access control lists, or network segmentation to further protect the server from unauthorized access.

Compliant code​

import java.io.IOException;
import java.net.ServerSocket;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpServlet;

public class OpenPortsServlet extends HttpServlet {

    private static final int MIN_PORT = 5000;
    private static final int MAX_PORT = 5100;

    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        for (int port = MIN_PORT; port <= MAX_PORT; port++) {
            try {
                ServerSocket server = new ServerSocket(port);
                server.close();
            } catch (IOException e) {
                // The port is open. Do something...
            }
        }
    }
}

The updated code now limits the range of ports that are being scanned. Instead of scanning all ports from 1 to 65535, we have specified a smaller range of ports (5000 to 5100) that are necessary for the application. This reduces the risk of exposing unnecessary ports and services to potential attackers.

In addition to this code change, it's important to implement other security measures:

  • Input validation and sanitization: Ensure that only valid and expected input is processed. This can prevent attacks such as SQL injection, cross-site scripting (XSS), and command injection.

  • Rate limiting or throttling mechanisms: Prevent excessive scanning or enumeration attempts. This can help to protect against brute-force attacks and denial-of-service (DoS) attacks.

  • Regularly review and update the security group configuration: Ensure that only necessary ports are open. This can help to minimize the attack surface of the server.

  • Network monitoring and intrusion detection systems: Detect and respond to any unauthorized scanning or enumeration attempts. This can help to identify potential security threats and respond to them quickly.

  • Additional security measures: Implement firewall rules, access control lists, or network segmentation to further protect the server from unauthorized access. This can provide additional layers of security and help to defend against a wide range of attacks.

References​

Last updated on