Source Code Disclosure (Tomcat)

Summary #

Netsparker identified a source code disclosure (Tomcat), which discloses server-side source code.

An attacker might obtain server-side source code of the web application which can contain sensitive data, such as database connection strings, usernames and passwords, along with the technical and business logic of the application.

Impact #

Depending on the source code, database connection strings, username and passwords, the internal workings and business logic of application might be revealed. With such information, an attacker can mount the following types of attacks:

Access the database or other data resources. Depending on the privileges of the account obtained from the source code, it may be possible to read, update or delete arbitrary data from the database.
Gain access to password protected administrative mechanisms such as dashboards, management consoles and admin panels, hence gaining full control of the application.
Develop further attacks by investigating the source code for input validation errors and logic vulnerabilities.

Actions To Take #

Ensure that the server has all the current security patches applied.
Set the allowLinking attribute to false on the Tomcat configuration for Windows systems.

Required Skills for Successful Exploitation #

This is dependent on the information obtained from the source code. Uncovering these forms of vulnerabilities does not require high levels of skills. However, a highly skilled attacker could leverage this form of vulnerability to obtain account information from databases or administrative panels, ultimately leading to the control of the application or even the host that the application resides on.

Classifications #

CAPEC-118; CWE-540; HIPAA-164.306(a), 164.308(a); ISO27001-A.9.4.5; WASC-13; OWASP 2013-A5; OWASP 2017-A3 , CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Netsparker Security Insights #

Helpful Use Cases #

Best Veracode Alternative