← Back to Apache Tomcat Application Server 9 Security Technical Implementation Guide

V-222975

CAT II (Medium)

ErrorReportValve showServerInfo must be set to false.

Rule ID

SV-222975r961167_rule

STIG

Apache Tomcat Application Server 9 Security Technical Implementation Guide

Version

V3R4

CCIs

CCI-001312

Discussion

The Error Report Valve is a simple error handler for HTTP status codes that will generate and return HTML error pages. It can also be configured to return pre-defined static HTML pages for specific status codes and/or exception types. Disabling showServerInfo will only return the HTTP status code and remove all CSS from the default non-error related HTTP responses.

Check Content

As an elevated user on the Tomcat server run the following command:

sudo grep -i ErrorReportValve $CATALINA_BASE/conf/server.xml file.

If the ErrorReportValve element is not defined and showServerInfo set to "false", this is a finding.

EXAMPLE:
&lt;Host ...&gt;
  ...
  &lt;Valve className="org.apache.catalina.valves.ErrorReportValve" showServerInfo="false"/&gt;
  ...
&lt;/Host&gt;

Fix Text

As a privileged user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Create or modify an ErrorReportValve &lt;Valve&gt; element nested beneath each &lt;Host&gt; element.

EXAMPLE:
&lt;Host name="localhost"  appBase="webapps"
            unpackWARs="true" autoDeploy="false"&gt;
...
&lt;Valve className="org.apache.catalina.valves.ErrorReportValve" 
showServerInfo="false" /&gt;
...
&lt;/Host&gt;

Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload