11 - JSP Regeneration

Information

If you do not need automatic regeneration of JSP pages, set up the Web Subsystem to not regenerate the content automatically. This can prevent someone injecting code in your JSP resources and compiling them without your knowledge.

Solution

The 'Development' value set to false will prevent JSP resources being automatically generated and force a restart in order to implement the changes.

<connector>
....
</connector>
<virtual-server name="...." enable-welcome-root="false">
....
</virtual-server>
<configuration>
<jsp-configuration development="false"/>
</configuration>

See Also

https://docs.jboss.org/author/display/AS72/Hardening+Guidelines

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b.

Plugin: Unix

Control ID: f36333ca099f0e84c9d837ebe36250d8385fd1618fdcabc6634f87f9508c481a