Detections
Analytics

TCAT-AS-000920 - ErrorReportValve showServerInfo must be set to false.

Information

The Error Report Valve is a simple error handler for HTTP status codes that will generate and return HTML error pages. It can also be configured to return pre-defined static HTML pages for specific status codes and/or exception types. Disabling showServerInfo will only return the HTTP status code and remove all CSS from the default non-error related HTTP responses.

Solution

As a privileged user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Create or modify an ErrorReportValve <Valve> element nested beneath each <Host> element.

EXAMPLE:
<Host name='localhost' appBase='webapps'
 unpackWARs='true' autoDeploy='false'>
...
<Valve className='org.apache.catalina.valves.ErrorReportValve'
showServerInfo='false' />
...
</Host>

Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Tomcat_Application_Server_9_V3R3_STIG.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-11a., CAT|II, CCI|CCI-001312, Rule-ID|SV-222975r961167_rule, STIG-ID|TCAT-AS-000920, STIG-Legacy|SV-111473, STIG-Legacy|V-102533, Vuln-ID|V-222975

Plugin: Unix

Control ID: 62ea6dc3abd4ebf64ec5c7a62a36f73f1cbfa17a046cb2a654709d639067feb7