10.8 Do not allow additional path delimiters - ALLOW_ENCODED_SLASH

Information

Being able to specify different path-delimiters on Tomcat creates the possibility that an attacker can access applications that were previously blocked by a proxy like mod_proxy.

Rationale:

Allowing additional path-delimiters allows for an attacker to get to an application or area which was not previously visible.

Solution

To start Tomcat with ALLOW_BACKSLASH and ALLOW_ENCODED_SLASH set to false, add -Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=false and -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=false to your startup script.

Default Value:

By default both parameters are set to false.

References:

https://tomcat.apache.org/tomcat-8.0-doc/config/systemprops.html

See Also

https://workbench.cisecurity.org/files/2506

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv7|5.1

Plugin: Unix

Control ID: 13d96340b48051a4678c2e76cc7306293cf7b9c44e081ffe3b6a345ab0f4ae93