← Back to Apache Tomcat Application Server 9 Security Technical Implementation Guide

V-222977

CAT II (Medium)

ErrorReportValve showReport must be set to false.

Rule ID

SV-222977r961170_rule

STIG

Apache Tomcat Application Server 9 Security Technical Implementation Guide

Version

V3R4

CCIs

CCI-001314

Discussion

The Error Report Valve is a simple error handler for HTTP status codes that will generate and return HTML error pages. It can also be configured to return pre-defined static HTML pages for specific status codes and/or exception types. Disabling showReport will result in no error message or stack trace being send to the client. This setting can be tailored on a per-application basis within each application specific web.xml.

Check Content

As an elevated user on the Tomcat server run the following command:

sudo grep -i ErrorReportValve $CATALINA_BASE/conf/server.xml file.

If the ErrorReportValve element is not defined and showReport set to "false", this is a finding.

EXAMPLE:
&lt;Host ...&gt;
  ...
  &lt;Valve className="org.apache.catalina.valves.ErrorReportValve" showReport="false"/&gt;
  ...
&lt;/Host&gt;

Fix Text

As a privileged user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Create or modify an ErrorReportValve &lt;Valve&gt; element nested beneath each &lt;Host&gt; element.

EXAMPLE:
&lt;Host name="localhost"  appBase="webapps"
            unpackWARs="true" autoDeploy="false"&gt;
...
&lt;Valve className="org.apache.catalina.valves.ErrorReportValve" 
showReport="false" /&gt;

&lt;/Host&gt;

Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload