STIGQter: STIG Summary: Apache Tomcat Application Sever 9 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

Tomcat default ROOT web application must be removed.

DISA Rule

SV-222959r615938_rule

Vulnerability Number

V-222959

Group Title

SRG-APP-000141-AS-000095

Rule Version

TCAT-AS-000570

Severity

CAT III

CCI(s)

• CCI-000381 - The organization configures the information system to provide only essential capabilities.

Weight

10

Fix Recommendation

WARNING: Removing the ROOT folder without replacing the content with valid web based content will result in an error page being displayed to the browser when the browser lands on the default page.

From the Tomcat server OS:

Either remove the files contained in $CATALINA_BASE/webapps/ROOT folder or replace the content of the folder with a new application that serves as the new default server application.

Check Contents

From the Tomcat server OS type the following command:

sudo ls -l $CATALINA_BASE/webapps/ROOT

Review the index.jsp file. Also review the RELEASE-NOTES.txt file. Look for content that describes the application as being licensed by the Apache Software Foundation. Check the index.jsp for other verbiage that indicates the application is part of the Tomcat server. Alternatively, use a web browser and access the default web application and determine if the website application in the ROOT folder is provided with the Apache Tomcat server.

If the ROOT web application contains Tomcat default application content, this is a finding.

Vulnerability Number

V-222959

Documentable

False

Rule Version

TCAT-AS-000570

Severity Override Guidance

From the Tomcat server OS type the following command:

sudo ls -l $CATALINA_BASE/webapps/ROOT

Review the index.jsp file. Also review the RELEASE-NOTES.txt file. Look for content that describes the application as being licensed by the Apache Software Foundation. Check the index.jsp for other verbiage that indicates the application is part of the Tomcat server. Alternatively, use a web browser and access the default web application and determine if the website application in the ROOT folder is provided with the Apache Tomcat server.

If the ROOT web application contains Tomcat default application content, this is a finding.

Check Content Reference

M

Target Key

4094

Comments