Inappropriate coding practices - System exit
Description
The J2EE application use System.exit(), it is undesirable for a web application to attempt to shut down the application container. Accessing a function that can shut down the application is an avenue for denial of service (DoS) attacks.
Impact
- Temporarily or permanently deny access to the application resource.
Recommendation
Delegate shutdown functions only to privileged and duly authorized accesses.
Threat
Authenticated attacker from the Internet.
Expected Remediation Time
⌚ 15 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the vulnerability.
Base
- Attack vector: N
- Attack complexity: H
- Privileges required: L
- User interaction: N
- Scope: U
- Confidentiality: N
- Integrity: N
- Availability: L
Temporal
- Exploit code madurity: U
- Remediation level: U
- Report confidence: R
Result
- Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:U/RC:R
- Score:
- Base: 3.1
- Temporal: 2.8
- Severity:
- Base: Low
- Temporal: Low
Code Examples
Compliant code
The application does not have any system.exit() in the source code
Public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
try {
...
} catch (ApplicationSpecificException ase) {
logger.error("Caught: " + ase.toString());
}
}
Non compliant code
There are system.exit() in the code
Public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
try {
...
} catch (ApplicationSpecificException ase) {
logger.error("Caught: " + ase.toString());
System.exit(1);
}
}
Requirements
- 164. Use optimized structures
- 167. Close unused resources
- 072. Set maximum response time
- 327. Set a rate limit
Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.