Welcome Web Application must be disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-62271	JBOS-AS-000245	SV-76761r1_rule		Low

Description
The Welcome to JBoss web page provides a redirect to the JBoss admin console, which, by default, runs on TCP 9990 as well as redirects to the Online User Guide and Online User Groups hosted at locations on the Internet. The welcome page is unnecessary and should be disabled or replaced with a valid web page.

STIG	Date
JBoss EAP 6.3 Security Technical Implementation Guide	2020-06-12

Details

Check Text ( C-63075r1_chk )
Use a web browser and browse to HTTP://JBOSS SERVER IP ADDRESS:8080 If the JBoss Welcome page is displayed, this is a finding.

Fix Text (F-68191r1_fix)
Use the Management CLI script JBOSS_HOME/bin/jboss-cli.sh to run the following command. You may need to change the profile to modify a different managed domain profile, or remove the "/profile=default" portion of the command for a standalone server. "/profile=default/subsystem=web/virtual-server=default-host:writeattribute(name=enable-welcome-root,value=false)" To configure your web application to use the root context (/) as its URL address, modify the applications jboss-web.xml, which is located in the applications META-INF/ or WEB-INF/ directory. Replace its directive with one that looks like the following: /

Fix Text (F-68191r1_fix)

Use the Management CLI script JBOSS_HOME/bin/jboss-cli.sh to run the following command. You may need to change the profile to modify a different managed domain profile, or remove the "/profile=default" portion of the command for a standalone server.

"/profile=default/subsystem=web/virtual-server=default-host:writeattribute(name=enable-welcome-root,value=false)"

To configure your web application to use the root context (/) as its URL address, modify the applications jboss-web.xml, which is located in the applications META-INF/ or WEB-INF/ directory. Replace its directive with one that looks like the following: