CWE-246 Variant Draft

J2EE Bad Practices: Direct Use of Sockets

This vulnerability occurs when a J2EE application creates network sockets directly, bypassing the container-managed communication framework provided by the platform.

Definition

What is CWE-246?

This vulnerability occurs when a J2EE application creates network sockets directly, bypassing the container-managed communication framework provided by the platform.

The J2EE specification restricts direct socket use primarily for connecting to legacy systems when no higher-level alternative exists. When developers implement custom network protocols or even re-implement standard ones, they must solve complex security challenges—like proper authentication, encryption, and input validation—that are already handled by the platform's tested frameworks. Without deep security expertise, these custom solutions often introduce critical flaws that attackers can exploit. Managing this at scale is difficult; an ASPM like Plexicus can help you track and remediate these flaws across your entire stack. While SAST tools can flag the direct socket usage pattern, Plexicus uses AI to analyze the context and suggest the specific framework-based code fix, such as replacing raw sockets with a managed service, saving hours of manual investigation and rewrite.

Auswirkungen in der Praxis

Real-world CVEs caused by CWE-246

Bisher sind in MITREs Katalog keine öffentlichen CVE-Referenzen mit dieser CWE verknüpft.

Wie Angreifer es ausnutzen

Angreiferpfad Schritt für Schritt

1
Identifiziere einen Codepfad, der nicht vertrauenswürdige Eingaben ohne Validierung verarbeitet.
2
Erzeuge eine Payload, die das unsichere Verhalten auslöst — Injection, Traversal, Overflow oder Logik-Missbrauch.
3
Liefere die Payload über einen normalen Request aus und beobachte die Reaktion der Anwendung.
4
Iteriere, bis die Antwort Daten preisgibt, Angreifer-Code ausführt oder Berechtigungen eskaliert.

Verwundbares Codebeispiel

Vulnerable Java

The following example opens a socket to connect to a remote server.

Verwundbar Java

public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
```
// Perform servlet tasks.* 
  		...
  		
  		
  		 *// Open a socket to a remote server (bad).* 
  		Socket sock = null;
  		
  		try {
  		```
  				sock = new Socket(remoteHostname, 3000);
```
// Do something with the socket.* 
  				...} catch (Exception e) {
  		```
  			...
  		}
  }

Sicheres Codebeispiel

Secure pseudo

Sicher pseudo

// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}

What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.

Präventions-Checkliste

How to prevent CWE-246

Architecture and Design Use framework method calls instead of using sockets directly.

Erkennungssignale

How to detect CWE-246

Automated Static Analysis High

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

CWE-246

Don't catalog this weakness. Prove it's reachable.

Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.

Request AI Swarm Pentest

Häufig gestellte Fragen

Frequently asked questions

Was ist CWE-246?

This vulnerability occurs when a J2EE application creates network sockets directly, bypassing the container-managed communication framework provided by the platform.

Wie gravierend ist CWE-246?

MITRE hat für diese Schwachstelle keine Exploit-Wahrscheinlichkeit veröffentlicht. Behandle sie als mittlere Auswirkung, bis dein Threat Model anderes belegt.

Welche Sprachen oder Plattformen sind von CWE-246 betroffen?

MITRE lists the following affected platforms: Java.

Wie kann ich CWE-246 verhindern?

Use framework method calls instead of using sockets directly.

Wie erkennt und behebt Plexicus CWE-246?

Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-246 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.

Wo erfahre ich mehr über CWE-246?

MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/246.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.

Verwandte Schwachstellen

Weaknesses related to CWE-246

CWE-695 Parent

Bereit zu validieren, was zählt.

Plexicus ist Proof-Driven AppSec: validierte Funde, kontextuelles Verständnis und geprüfte Remediation — in Evidenz verankert, mit Ihnen gescoped.

Pentest buchen

J2EE Bad Practices: Direct Use of Sockets

What is CWE-246?

Real-world CVEs caused by CWE-246

Angreiferpfad Schritt für Schritt

Vulnerable Java

Secure pseudo

How to prevent CWE-246

How to detect CWE-246

Don't catalog this weakness. Prove it's reachable.

Frequently asked questions

Weaknesses related to CWE-246

Use of Low-Level Functionality

Direct Use of Unsafe JNI

J2EE Bad Practices: Direct Management of Connections

J2EE Bad Practices: Direct Use of Threads

EJB Bad Practices: Use of Synchronization Primitives

EJB Bad Practices: Use of AWT Swing

EJB Bad Practices: Use of Java I/O

Further reading

Bereit zu validieren, was zählt.

Prüfen Sie, ob AI Swarm Pentest zu Ihrer Umgebung passt.

Anfrage erhalten. Nächsten Schritt buchen.

Sample evidence handover

Server-Side Request Forgery in `webhooks/receiver`