CWE-576: EJB Bad Practices: Use of Java I/O

How it's found

EJB Bad Practices: Use of Java I/O is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.

The Enterprise JavaBeans specification requires that every bean provider follow a set of programming guidelines designed to ensure that the bean will be portable and behave consistently in any EJB container. In this case, the product violates the following EJB guideline: "An enterprise bean must not use the java.io package to attempt to access files and directories in the file system." The specification justifies this requirement in the following way: "The file system APIs are not well-suited for business components to access data. Business components should use a resource manager API, such as JDBC, to store data."

Vulnerable vs. safe

/* get XML document from the local filesystem */
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();DocumentBuilder db = dbf.newDocumentBuilder();interestRateXMLDocument = db.parse(interestRateFile);interestRateFile = new File(Constants.INTEREST_RATE_FILE);if (interestRateFile.exists()){}try {} catch (IOException ex) {...}

return getInterestRateFromXML(points);/* member function to retrieve interest rate from XML document on the local file system */private Document interestRateXMLDocument = null;private File interestRateFile = null;public InterestRateBean() {}public BigDecimal getInterestRate(Integer points) {}private BigDecimal getInterestRateFromXML(Integer points) {...}@Statelesspublic class InterestRateBean implements InterestRateRemote {}

return getInterestRateFromXMLParser(points);/* member function to retrieve interest rate from XML document using an XML parser API */public InterestRateBean() {}public BigDecimal getInterestRate(Integer points) {}private BigDecimal getInterestRateFromXMLParser(Integer points) {...}@Statelesspublic class InterestRateBean implements InterestRateRemote {}

Consequences

• Quality Degradation

Mitigations

• Implementation: Do not use Java I/O when writing EJBs.

Where this fits in a TurboPentest engagement

TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.

Frequently asked questions

Related CWEs

• Base weakness
  CWE-695: Use of Low-Level Functionality