5.3.5. Container

Common Java servers include Tomcat, Weblogic, JBoss, GlassFish, Jetty, Resin, IBM Websphere, etc. Here is a brief description of some of the frameworks.

5.3.5.1. Tomcat

Tomcat is a lightweight application server, which is commonly used in small and medium-sized systems and occasions where there are not many concurrent access users to develop and debug JSP programs.

After receiving the request, Tomcat’s processing flow is as follows:

  • The client accesses the web server and sends an HTTP request

  • After the web server receives the request, it passes it to the servlet container

  • The servlet container loads the servlet, generates a servlet instance, and passes it objects representing requests and responses

  • The servlet instance uses the request object to get the client’s request information, and then processes it accordingly

  • The servlet instance sends the processing result back to the client through the response object, and the container is responsible for ensuring that the response is sent correctly and returning control to the web server

The Tomcat server is composed of a series of configurable components, the core component of which is the Catalina Servlet container, which is the top-level container for all other Tomcat components.

5.3.5.2. Weblogic

5.3.5.2.1. Introduction

WebLogic is an Application Server produced by Oracle Corporation of the United States. It is a middleware based on Java EE architecture. WebLogic is a Java application server used to develop, integrate, deploy and manage large-scale distributed Web applications, network applications and database applications. It brings the dynamic capabilities of Java and the security of Java Enterprise standards into the development, integration, deployment and management of large-scale web applications.

WebLogic’s comprehensive support for a variety of industry standards, including EJB, JSP, Servlet, JMS, JDBC, and more.

5.3.5.3. JBoss

5.3.5.3.1. Introduction

JBoss is a container and server for managing EJB based on J2EE, but the core service of JBoss does not include a WEB container that supports servlet/JSP, and is generally used in combination with Tomcat or Jetty.

5.3.5.3.2. Related CVE

  • CVE-2017-12149

    • Deserialization Vulnerability

    • access /invoker/readonly, there is a deserialization vulnerability when the page exists

5.3.5.4. Jetty

5.3.5.4.1. Introduction

Jetty is an open source servlet container.