How do I prevent access to WEB-INF via HTTP GET in WildFly 10?

[sjeaves2]

I'm tasked to close some security holes in our web-based application (powered by Java servlets). Using an in-house tool that allows us to submit "raw" HTTP requests (like you can with Telnet), we've discovered that, while POST requests forbid access, GET requests honor a request with a relative pathname like so:

http://myhost.com:8080/ServletName/..\WEB-INF\web.xml

From what I've read, access to the WEB-INF directory is restricted, but as I've said, when I do a GET on WildFly 10 (standalone) with a "raw" HTTP request tool, the request is honored.

[jaikiran]

That's clearly a bug. Having said that, I remember such issues have been fixed in newer releases of WildFly. Have you tried upgrading to latest released WildFly (14 currently) and see if it's still reproducible?

[msystems]

I'm using WildFly 14.0.1 and it's not possible to access the WEB-INF with a GET request with a relative pathname like http://myhost.com:8080/ServletName/..\WEB-INF\web.xml - you will get an '404 - Not Found'.

[sjeaves2]

I will try an upgrade and see how that works.

[sjeaves2]

Thanks for the confirmation.  I'm not sure that we are able to move to a higher version here yet, but it is good to know that this is a bug in WildFly and not in our code.