Description
The J2EE application directly uses sockets instead of using framework method calls.
The J2EE standard permits the use of sockets only for the purpose of communication with legacy systems when no higher-level protocol is available. Authoring your own communication protocol requires wrestling with difficult security issues. Without significant scrutiny by a security expert, chances are good that a custom communication protocol will suffer from security problems. Many of the same issues apply to a custom implementation of a standard protocol. While there are usually more resources available that address security concerns related to implementing a standard protocol, these resources are also available to attackers.
Potential Impact
Other
Quality Degradation
Demonstrative Examples
public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
// Perform servlet tasks.
...
// Open a socket to a remote server (bad).
Socket sock = null;
try {
sock = new Socket(remoteHostname, 3000);
// Do something with the socket.
...
} catch (Exception e) {...}
}Mitigations & Prevention
Use framework method calls instead of using sockets directly.
Detection Methods
- Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea
Related Weaknesses
Taxonomy Mappings
- 7 Pernicious Kingdoms: — J2EE Bad Practices: Sockets
- Software Fault Patterns: SFP3 — Use of an improper API
Frequently Asked Questions
What is CWE-246?
CWE-246 (J2EE Bad Practices: Direct Use of Sockets) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Variant-level weakness. The J2EE application directly uses sockets instead of using framework method calls.
How can CWE-246 be exploited?
Attackers can exploit CWE-246 (J2EE Bad Practices: Direct Use of Sockets) to quality degradation. This weakness is typically introduced during the Implementation phase of software development.
How do I prevent CWE-246?
Key mitigations include: Use framework method calls instead of using sockets directly.
What is the severity of CWE-246?
CWE-246 is classified as a Variant-level weakness (Low-Medium abstraction). Its actual severity depends on the specific context and how the weakness manifests in your application.