cis-tomcat10-v110-2-6

name	cis-tomcat10-v110-2.6
description	Turn off TRACE (Automated)
category	cis-tomcat
version	1.1.0
author	cyberstrike-official
tags	["cis","tomcat","linux","java","information-leakage","server-info"]
cis_id	2.6
cis_benchmark	CIS Apache Tomcat 10 Benchmark v1.1.0
tech_stack	["linux","tomcat","java"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Turn off TRACE (Automated)

Description

The HTTP TRACE verb provides debugging and diagnostics information for a given request.

Rationale

Diagnostic information, such as that found in the response to a TRACE request, often contains sensitive information which may useful to an attacker. By preventing Tomcat from providing this information, the risk of leaking sensitive information to a potential attacker is reduced.

Audit Procedure

Perform the following to determine if the server platform, as advertised in the HTTP Server header, has been changed:

1. Locate all Connector elements in $CATALINA_HOME/conf/server.xml.
2. Ensure each Connector does not have an allowTrace attribute or, if present, the allowTrace attribute is NOT set true.

Perform the following for each application hosted within Tomcat with a web-app root element in the web.xml:

1. Locate each application instance of web.xml in $CATALINA_HOME/webapps/<app_name>/WEB-INF/web.xml.
2. Ensure a security-constraint/web-resource-collection exists the child value pairings:
   1. web-resource-name with a value of restricted methods.
   2. url-pattern with a value of /*.
   3. http-method with a value of TRACE.

Remediation

Perform the following to prevent Tomcat from accepting a TRACE request:

1. Set the allowTrace attribute for each Connector specified in $CATALINA_HOME/conf/server.xml to false.

<Connector ... allowTrace="false" />

Alternatively, ensure the allowTrace attribute is absent from each Connector specified in $CATALINA_HOME/conf/server.xml.

2. Add the following as a child of the web-app root element, if present, in each applications web.xml:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>restricted methods
        ...
        TRACE
        ...
    
    ...