Verb tampering via misconfigured security constraint

Description

This web application is using a security-constraint section that includes a web-resource-collection section with one or more http-method definitions. It's not recommended to use http-method definitions. When listing specific methods in their configuration, developers are actually allowing more access than they intend. It's safer to remove all http-method definitions.

Example vulnerable config:

 <security-constraint>
        <web-resource-collection>
          <web-resource-name>adminres</web-resource-name>
          <url-pattern>/admin/*</url-pattern>
          <http-method>GET</http-method>
        </web-resource-collection>
        <auth-constraint>
                <role-name>admin</role-name>
        </auth-constraint>
 </security-constraint>

Remediation

Remove all <strong>http-method</strong> definitions from the <strong>security-constraint</strong> section. <br/><br/> Example safer config: <pre> &lt;security-constraint&gt; &lt;web-resource-collection&gt; &lt;web-resource-name&gt;adminres&lt;/web-resource-name&gt; &lt;url-pattern&gt;/admin/*&lt;/url-pattern&gt; &lt;/web-resource-collection&gt; &lt;auth-constraint&gt; &lt;role-name&gt;admin&lt;/role-name&gt; &lt;/auth-constraint&gt; &lt;/security-constraint&gt; </pre>

References

Related Vulnerabilities