Need

Restrict usage of console functions in production environments

Context

• Usage of Java for building robust and scalable applications
• Usage of javax.servlet for building Java web applications
• Usage of java.io for input and output operations in Java

Description

Non compliant code

        import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
 
public class VulnerableServlet extends HttpServlet {
 
    public void doGet(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, IOException {
 
        String userInput = request.getParameter("userInput");
 
        System.out.println("User input is: " + userInput);
        System.err.println("Error message for user input: " + userInput);
 
    }
}
        
        

The above Java Servlet code is vulnerable to technical information leakage through the use of console functions such as System.out.println() and System.err.println().

The Servlet takes in a user input from the request parameter 'userInput' and directly prints it out to the console using System.out.println(). This is a potential security risk as it exposes the internal workings of the application, including possibly sensitive data, to anyone who has access to the console logs.

Similarly, the System.err.println() function is used to print error messages to the console. This can reveal information about the application's error handling and logic, which could be used by an attacker to exploit the system.

In a production environment, this kind of information leakage could lead to a variety of attacks, including data theft, system exploitation, and other forms of abuse. Therefore, it is a best practice to avoid using console functions to print sensitive data or information that could reveal the internal workings of the application.

Steps

• Avoid using console functions (log, info, warning) in production environments.
• Remove or comment out the console functions (System.out.println and System.err.println) in the code.
• Instead of using console functions, consider using a logging framework to handle logging in a more controlled and secure manner.
• Configure the logging framework to log only necessary and non-sensitive information.
• Ensure that sensitive information, such as user input, is not logged or is properly sanitized before logging.
• Regularly review and update the logging configuration to minimize the risk of information leakage.

Compliant code

        import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
 
public class SecureServlet extends HttpServlet {
 
    private static final Logger logger = LoggerFactory.getLogger(SecureServlet.class);
 
    public void doGet(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, IOException {
 
        String userInput = request.getParameter("userInput");
 
        // System.out.println("User input is: " + userInput);
        // System.err.println("Error message for user input: " + userInput);
        logger.info("User input is received.");
    }
}
        
        

The original code was vulnerable due to the use of console functions (System.out.println and System.err.println) which can lead to information leakage in production environments.

The revised code removes these console functions and instead uses a logging framework (SLF4J in this case) to handle logging. The logger is configured to log only necessary and non-sensitive information. In this case, it logs a generic message indicating that user input has been received, without logging the actual input.

The use of a logging framework provides a more controlled and secure way to handle logging. It can be configured to log only necessary information, and to sanitize any sensitive information before logging. This minimizes the risk of information leakage.

It's important to regularly review and update the logging configuration to ensure it remains secure and effective.

References

• 066. Technical information leak - Console functions