10.8 Do not allow additional path delimiters - ALLOW_ENCODED_SLASH

Information

Being able to specify different path-delimiters on Tomcat creates the possibility that an attacker can access applications that were previously blocked by a proxy like mod_proxy.

Rationale:

Allowing additional path-delimiters allows for an attacker to get to an application or area which was not previously visible.

Solution

To start Tomcat with ALLOW_BACKSLASH and ALLOW_ENCODED_SLASH set to false, add -Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=false and -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=false to your startup script in setenv.sh in CATALINA_BASE/bin.

Default Value:

By default both parameters are set to false.

See Also

https://workbench.cisecurity.org/files/4107

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|5.1

Plugin: Unix

Control ID: a2b015d2b5df4779d4b36c16ebb0a4c441c83343cea6baedb97a4094a2ea6019