UCF STIG Viewer Logo

DefaultServlet directory listings parameter must be disabled.


Overview

Finding ID Version Rule ID IA Controls Severity
V-222954 TCAT-AS-000520 SV-222954r615938_rule Low
Description
The DefaultServlet serves static resources as well as directory listings. It is declared globally in $CATALINA_BASE/conf/web.xml and by default is configured with the directory "listings" parameter set to disabled. If no welcome file is present and the "listings" setting is enabled, a directory listing is shown. Directory listings must be disabled.
STIG Date
Apache Tomcat Application Sever 9 Security Technical Implementation Guide 2020-12-11

Details

Check Text ( C-24626r426306_chk )
From the Tomcat server run the following OS command:

sudo cat $CATALINA_BASE/conf/web.xml |grep -i -A10 -B2 defaultservlet

The above command will include ten lines after and two lines before the occurrence of "defaultservlet". Some systems may require that the user increase the after number (A10) in order to determine the "listings" param-value.

If the "listings" param-value for the "DefaultServlet" servlet class does not = "false", this is a finding.
Fix Text (F-24615r426307_fix)
From the Tomcat server as a privileged user:

Edit the $CATALINA_BASE/conf/web.xml file.

Examine the elements within the element, if the "listings" element is "true" change the "listings" to read "false".

sudo systemctl restart tomcat
sudo systemctl daemon-reload