cis-tomcat9-v120-10-8

name	cis-tomcat9-v120-10.8
description	Do not allow additional path delimiters (Manual)
category	cis-tomcat
version	1.2.0
author	cyberstrike-official
tags	["cis","tomcat","linux","java","configuration","hardening","security"]
cis_id	10.8
cis_benchmark	CIS Apache Tomcat 9 Benchmark v1.2.0
tech_stack	["linux","tomcat","java"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

10.8 Do not allow additional path delimiters (Manual)

Description

Being able to specify different path-delimiters on Tomcat creates the possibility that an attacker can access applications that were previously blocked by a proxy like mod_proxy.

Rationale

Allowing additional path-delimiters allows for an attacker to get to an application or area which was not previously visible.

Audit Procedure

Ensure the -Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=false and -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=false parameters are added to the startup script which, by default, is located at $CATALINA_HOME/bin/catalina.sh.

Remediation

To start Tomcat with ALLOW_BACKSLASH and ALLOW_ENCODED_SLASH set to false, add -Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=false and -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=false to your startup script in setenv.sh in CATALINA_BASE/bin.

Default Value

By default both parameters are set to false.

References

1. https://tomcat.apache.org/tomcat-9.0-doc/config/systemprops.html

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	16.7 Use Standard Hardening Configuration Templates for Application Infrastructure Use standard, industry-recommended hardening configuration templates for application infrastructure components. This includes underlying servers, databases, and web servers, and applies to cloud containers, Platform as a Service (PaaS) components, and SaaS components. Do not allow in-house developed software to weaken configuration hardening.		●	●
v7	5.1 Establish Secure Configurations Maintain documented, standard security configuration standards for all authorized operating systems and software.	●	●	●

Profile

Level 2