Book a Security Review

Weakness · Medium

CWE-382: J2EE Bad Practices: Use of System.exit()

What it is

A J2EE application uses System.exit(), which also shuts down its container.

MITRE CWE 4.19.1

Severity (our rating)
Medium
Likelihood of exploit
Not rated by MITRE
Introduced during
Implementation
Exploited in the wild
No CVE in CISA's catalog

In more detail

It is never a good idea for a web application to attempt to shut down the application container. Access to a function that can shut down the application is an avenue for Denial of Service (DoS) attacks.

What an attacker can do

  • DoS: Crash, Exit, or Restart (Availability)

How to prevent it

Architecture and Design

  • The shutdown function should be a privileged function available only to a properly authorized administrative user

Implementation

  • Web applications should not call methods that cause the virtual machine to exit, such as System.exit()
  • Web applications should also not throw any Throwables to the application server as this may adversely affect the container.
  • Non-web applications may have a main() method that contains a System.exit(), but generally should not call System.exit() from other locations in the code

How to find it

  • Automated Static Analysis. Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

CWE-382 on MITRE's CWE site

H2 Security

Found it in your code?

We review where it appears, fix it with your team, and check it was not already used against you.

Talk to our team

T Academy

Stop writing it in the first place

Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.

Start free

Source: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.