Detections
Analytics

TCAT-AS-000940 - ErrorReportValve showReport must be set to false.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The Error Report Valve is a simple error handler for HTTP status codes that will generate and return HTML error pages. It can also be configured to return pre-defined static HTML pages for specific status codes and/or exception types. Disabling showReport will result in no error message or stack trace being send to the client. This setting can be tailored on a per-application basis within each application specific web.xml.

Solution

As a privileged user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Create or modify an ErrorReportValve <Valve> element nested beneath each <Host> element.

EXAMPLE:
<Host name='localhost' appBase='webapps'
 unpackWARs='true' autoDeploy='false'>
...
<Valve className='org.apache.catalina.valves.ErrorReportValve'
showReport='false' />

</Host>

Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Tomcat_Application_Server_9_V3R3_STIG.zip

Item Details

References: CAT|II, CCI|CCI-001314, Rule-ID|SV-222977r961170_rule, STIG-ID|TCAT-AS-000940, STIG-Legacy|SV-111477, STIG-Legacy|V-102537, Vuln-ID|V-222977

Plugin: Unix

Control ID: 8c72096db963d18d0e47151521451a4f36336ab8c09fe5c6e9b7cabdaed99171