Is remote file execution attack possible in Java based web applications (servlet/java)?
Unless there is a programming error like executing commands that user supplies or there is service (a servlet or struts a开发者_运维技巧ction or any thing) that retrieves a file whatever user passes as input, is there any way to execute a file on Java web server?
No, not really. If there is code to execute external programs, then it's possible that it could be exploited just as on any other service; but if there's no such code, and there is no crazy stuff that compiles and executes user data as Java code, then it's unlikely there would be any way to perform such an exploit.
Well, if you exclude programming errors completely; no. But you have to realize there are programming errors in the frameworks themselves, even though they might be more robust than your average system.
I have no knowledge of any vulnerabilities resulting in code execution in pure Java servlets.
As for Java web frameworks, there are many example. As an example, you could check out Meder Kydyraliev's slides here which have several that he has discovered:
Milking a horse or executing remote code in modern Java frameworks
You don't give much context, so it's hard to give a good answer. It all boils down to how secure you need your application to be.
精彩评论