CWE-575: EJB Bad Practices: Use of AWT Swing

How it's found

EJB Bad Practices: Use of AWT Swing is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.

The Enterprise JavaBeans specification requires that every bean provider follow a set of programming guidelines designed to ensure that the bean will be portable and behave consistently in any EJB container. In this case, the product violates the following EJB guideline: "An enterprise bean must not use the AWT functionality to attempt to output information to a display, or to input information from a keyboard." The specification justifies this requirement in the following way: "Most servers do not allow direct interaction between an application program and a keyboard/display attached to the server system."

Vulnerable vs. safe

/* member variables for receiving keyboard input using AWT API */

/* conversion rate on US dollars to Yen */

/* member functions for implementing AWT KeyListener interface */

/* member functions for receiving keyboard input and displaying output */
/* method calls for setting up AWT Component for receiving keyboard input */super();...addKeyListener(this);

BigDecimal result = dollars.multiply(yenRate);return result.setScale(2, BigDecimal.ROUND_DOWN);

......private StringBuffer enteredText = new StringBuffer();private BigDecimal yenRate = new BigDecimal("115.3100");public ConverterSessionBean() {}public BigDecimal dollarToYen(BigDecimal dollars) {}public void keyTyped(KeyEvent event) {}public void keyPressed(KeyEvent e) {}public void keyReleased(KeyEvent e) {}public void paint(Graphics g) {...}...@Statelesspublic class ConverterSessionBean extends Component implements KeyListener, ConverterSessionRemote {}

/* conversion rate on US dollars to Yen */

/* remote method to convert US dollars to Yen */
BigDecimal result = dollars.multiply(yenRate);return result.setScale(2, BigDecimal.ROUND_DOWN);private BigDecimal yenRate = new BigDecimal("115.3100");public ConverterSessionBean() {}public BigDecimal dollarToYen(BigDecimal dollars) {}@Statelesspublic class ConverterSessionBean implements ConverterSessionRemoteInterface {}

Consequences

• Quality Degradation

Mitigations

• Architecture and Design: Do not use AWT/Swing when writing EJBs.

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

Related CWEs

• Base weakness
  CWE-695: Use of Low-Level Functionality