DefaultServlet must be set to readonly for PUT and DELETE.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-222934	TCAT-AS-000090	SV-222934r557518_rule		Medium

Description
The Default servlet (or DefaultServlet) is a special servlet provided with Tomcat, which is called when no other suitable page is found in a particular folder. The DefaultServlet serves static resources as well as directory listings. The DefaultServlet is declared globally in $CATALINA_BASE/conf/web.xml and by default is configured with the "readonly" parameter set to true where HTTP commands like PUT and DELETE are rejected. Changing this to false allows clients to delete or modify static resources on the server and to upload new resources. DefaultServlet readonly must be set to true.

Description

The Default servlet (or DefaultServlet) is a special servlet provided with Tomcat, which is called when no other suitable page is found in a particular folder. The DefaultServlet serves static resources as well as directory listings. The DefaultServlet is declared globally in $CATALINA_BASE/conf/web.xml and by default is configured with the "readonly" parameter set to true where HTTP commands like PUT and DELETE are rejected. Changing this to false allows clients to delete or modify static resources on the server and to upload new resources. DefaultServlet readonly must be set to true.

STIG	Date
Apache Tomcat Application Sever 9 Security Technical Implementation Guide	2020-09-23

Details

Check Text ( C-24606r426246_chk )
From the Tomcat server run the following command: sudo cat $CATALINA_BASE/conf/web.xml \|grep -i -A5 -B2 defaultservlet If the "readonly" param-value does not exist, this is not a finding. If the "readonly" param-value for the "DefaultServlet" servlet class = "false", this is a finding.

Fix Text (F-24595r426247_fix)
From the Tomcat server console as a privileged user: Edit the $CATALINA_BASE/conf/web.xml file. If the "readonly" param-value does not exist, it must be created. Change the "readonly" param-value for the "DefaultServlet" servlet class = "true".