10.8 Do not allow additional path delimiters - ALLOW_BACKSLASH

Information

Being able to specify different path-delimiters on Tomcat creates the possibility that an attacker can access applications that were previously blocked by a proxy like mod_proxy.

Rationale:

Allowing additional path-delimiters allows for an attacker to get to an application or area which was not previously visible.

Solution

To start Tomcat with ALLOW_BACKSLASH and ALLOW_ENCODED_SLASH set to false, add -Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=false and -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=false to your startup script in setenv.sh in CATALINA_BASE/bin.

Default Value:

By default both parameters are set to false.

See Also

https://workbench.cisecurity.org/benchmarks/11652

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|5.1

Plugin: Unix

Control ID: d08fa259b2121e851889c1fd53367f8817831542d9a587c8ed1d7c4b5e161413