CWE-382: J2EE Bad Practices: Use of System.exit()
A J2EE application uses System.exit(), which also shuts down its container.
How it's found
J2EE Bad Practices: Use of System.exit() is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
It is never a good idea for a web application to attempt to shut down the application container. Access to a function that can shut down the application is an avenue for Denial of Service (DoS) attacks.
Consequences
- DoS: Crash, Exit, or Restart
Mitigations
- Architecture and Design: The shutdown function should be a privileged function available only to a properly authorized administrative user
- Implementation: Web applications should not call methods that cause the virtual machine to exit, such as System.exit()
- Implementation: Web applications should also not throw any Throwables to the application server as this may adversely affect the container.
- Implementation: Non-web applications may have a main() method that contains a System.exit(), but generally should not call System.exit() from other locations in the code
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-382?
A J2EE application uses System.exit(), which also shuts down its container.
How do you find J2EE Bad Practices: Use of System.exit()?
J2EE Bad Practices: Use of System.exit() is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
What is the impact of CWE-382?
DoS: Crash, Exit, or Restart
Does TurboPentest test for J2EE Bad Practices: Use of System.exit()?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
- Class weaknessCWE-705: Incorrect Control Flow Scoping
- Variant weaknessCWE-48: Path Equivalence: 'file name' (Internal Whitespace)
- Base weaknessCWE-170: Improper Null Termination
- Base weaknessCWE-369: Divide By Zero
- Class weaknessCWE-400: Uncontrolled Resource Consumption
- Variant weaknessCWE-401: Missing Release of Memory after Effective Lifetime
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest