How to resolve External Service Interaction issue in servlet.

[aem-enthu27]

Hi,

During penTest we found a security issue called External Service Interaction in servlet.

This servlet is called after submitting a form , which has 4-5 fileds .

Please let me know how to resolve this issue.

[SantoshSai]

Hi @aem-enthu27,

Perform DNS (Domain name system) lookups for hostnames in AEM.

Kindly refer below references for the same.

[0]: External Service Interaction (DNS)

Hope that helps!

Regards,

Santosh

[aem-enthu27]

No @SantoshSai  it is not helpfull , I have seen that question .

I think you have not read my question properly. Issue is with servlet.

Which is wriiten for some form with few query parameters .

[aanchal-sikka · Accepted solution]

The External Service Interaction vulnerability in a servlet typically occurs when the servlet interacts with external services without proper validation or authorization. Here's a general guideline:

1. Validate User Input: Ensure that all user inputs submitted through the form are properly validated and sanitized to prevent injection attacks such as SQL injection, XSS, etc. Ensure that only expected and safe inputs are accepted.

2. Implement Proper Authorization: Check if the servlet has proper authorization checks in place to verify whether the user has the necessary permissions to access the servlet and interact with external services. You can use AEM's user/group permissions or custom authorization mechanisms for this purpose.

3. Limit External Service Interaction: Minimize the interaction of the servlet with external services to only what is necessary for the application's functionality. Avoid exposing sensitive data or functionality unnecessarily and restrict the communication to trusted and verified external services.

4. Use Secure Communication Protocols: Ensure that any communication with external services is done over secure protocols such as HTTPS to encrypt the data in transit and prevent interception or tampering.