On-premise app: three small weaknesses chained together
October 2026. A client's on-premise Java web application on their own servers, which we were asked to investigate. An attacker took control of the application server and the database server over two days, and came back after the first clean-up.
What went wrong
No single weakness was dramatic. Together they gave full control.
| Weakness | Fix |
|---|---|
| Arbitrary file read in a small utility endpoint | Remove the endpoint; never pass file paths from requests |
| Application server's management console exposed with a password only | Remove it in production, or bind it to localhost and a management network |
| SQL built by string concatenation in an import feature | Parameterised queries everywhere |
| Application database user was a superuser | A least-privilege role that owns only its schema |
| Flat internal network | Segment app, database, directory and office networks |
| Day-1 containment only changed a password | Close every entry point before declaring containment |
Impact
- The production database restarted under load during the attack, causing an outage.
- User records (hashed passwords, emails, phone numbers), API tokens and integration keys were read.
- Attempts against the directory servers failed: they were patched, and file shares refused anonymous access.
How it was found
Only afterwards, from very large application log files. The logs recorded errors but not request paths or client addresses, so the first entry point is inferred, not proven.
Lessons
Containment is not a password change. List every way in, close each one, then rotate every credential, then watch for a return.
Access logs (path, client address, status) are kept for every web server. Error logs alone cannot tell you how someone got in.
Database errors are never shown to users. Detailed error messages can carry data out.
- Patching mattered: the one fully patched system type stopped the attack spreading.
- Assume one compromised server can reach every other server on a flat network.