CWE-577 is an EJB rule violation: a bean listens on a socket, accepts connections, or uses a socket for multicast.
MITRE quotes the specification. The EJB architecture allows a bean instance to be a network socket client, but not a network server, because becoming a server would conflict with the bean's basic function of serving EJB clients.
How it happens
MITRE's example is a stock symbol bean that creates a ServerSocket and accepts client connections.
// Vulnerable: bean acts as a network server
@Stateless
public class StockSymbolBean implements StockSymbolRemote {
ServerSocket serverSocket = null;
Socket clientSocket = null;
public StockSymbolBean() {
serverSocket = new ServerSocket(Constants.SOCKET_PORT);
clientSocket = serverSocket.accept();
...
}
}
Each bean instance tries to bind the same port, and a listening port the container does not manage is an unmonitored entry point.
What an attacker gains
MITRE lists quality degradation. An unexpected listener also adds attack surface: a service outside normal authentication and logging.
How to find it
Search bean classes for ServerSocket, DatagramSocket and MulticastSocket. Check listening ports on the host against what you expect. The record lists no detection methods.
How to fix it
MITRE's mitigation: do not use sockets when writing EJBs. Expose functionality through the bean's remote or web service interface and let the container handle networking. If you need to call out, a client socket is allowed.
@Stateless
public class StockSymbolBean implements StockSymbolRemote {
public BigDecimal priceOf(String symbol) {
return quotes.lookup(symbol);
}
}
Quick check
Can a bean open a client connection?
Yes. The specification allows a bean to be a socket client, but not a listener.
The free in-browser scan at gold.safeguard.sh/scan lists the dependencies in your manifest. No login is needed, the file stays on your machine, and it handles up to 100 dependencies.
