Source Code Disclosure - /WEB-INF folder

Source Code Disclosure is a serious vulnerability that can reveal sensitive information about your web application to attackers. The /WEB-INF folder is one of the most critical folders in a Java web application, as it contains important configuration files, libraries, and other resources that are not intended to be accessible to the public. In this guide, we will discuss the steps you can take to fix the Source Code Disclosure vulnerability in the /WEB-INF folder of your web application.

‍

Step 1: Disable Directory Listing

The first step in fixing the Source Code Disclosure vulnerability is to disable directory listing for the /WEB-INF folder. By default, most web servers will show a directory listing of the files in a folder if there is no index file present. This can be dangerous, as it can reveal sensitive information about your web application, such as the names of configuration files and libraries. To disable directory listing, add the following line to your web server configuration file:

Options -Indexes‍

This will prevent directory listing for all folders on your web server.

‍

If you only want to disable directory listing for the /WEB-INF folder, you can add the following line:

<Directory /path/to/your/webapp/WEB-INF> Options -Indexes </Directory>

Replace "/path/to/your/webapp" with the path to your web application directory.

‍

Step 2: Restrict Access to the /WEB-INF folder

The next step is to restrict access to the /WEB-INF folder. By default, this folder is not accessible from the web, but it is still possible for an attacker to guess the path to the folder and access it directly. To prevent this, add the following lines to your web server configuration file:

<Directory /path/to/your/webapp/WEB-INF> Deny from all </Directory>

This will deny access to the /WEB-INF folder from any IP address.

‍

Step 3: Use JSP Forwarding

Another way to prevent Source Code Disclosure is to use JSP forwarding instead of direct file inclusion. JSP forwarding allows you to include a file in a JSP page without revealing the path to the file. For example, instead of using the following code to include a file:

<%@ include file="/WEB-INF/config.properties" %>

‍

You can use the following code to forward the request to a servlet that will include the file:

<jsp:forward page="/servlet/ConfigPropertiesServlet" />

‍

The ConfigPropertiesServlet can then include the file using the following code:

InputStream inputStream = getServletContext().getResourceAsStream("/WEB-INF/config.properties");

This will prevent the path to the config.properties file from being revealed to the client.

‍

Step 4: Remove Sensitive Information from Configuration Files

Even if you have restricted access to the /WEB-INF folder, it is still possible for an attacker to gain access to your configuration files if they are not properly secured. To prevent this, you should remove any sensitive information from your configuration files, such as passwords and API keys. Instead, you can store this information in environment variables or a separate properties file that is not accessible from the web.

‍

Step 5: Update Libraries and Frameworks

Finally, it is important to keep your libraries and frameworks up-to-date to ensure that they do not contain any known vulnerabilities. Many Source Code Disclosure vulnerabilities are caused by outdated libraries or frameworks that contain security vulnerabilities. To update your libraries and frameworks, check for updates regularly and follow the instructions provided by the vendor to update your dependencies.

‍

Conclusion

Source Code Disclosure is a serious vulnerability that can reveal sensitive information about your web application to attackers. By following the steps outlined in this guide, you can prevent this vulnerability from being exploited in the /WEB-INF folder of your web application. Remember to regularly scan your web application for vulnerabilities using an external vulnerability scanner and to keep your libraries and frameworks up-to-date to ensure the security of your web application.

‍