cyberstrikeus 9.3 Disable deploy on startup of applications (Scored)
Description
Tomcat allows auto deployment of applications on startup. It is recommended that this capability be disabled.
Rationale
This could allow malicious or untested applications to be deployed and should be disabled.
Audit Procedure
Perform the following to ensure deployOnStartup is set to false.
$ grep "deployOnStartup" $CATALINA_HOME/conf/server.xml
Remediation
In the $CATALINA_HOME/conf/server.xml file, change deployOnStartup to false.
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="false"
deployOnStartup="false">
Default Value
deployOnStartup is set to true.
References
- https://tomcat.apache.org/tomcat-8.0-doc/deployer-howto.html#Deployment_on_Tomcat_startup
- https://tomcat.apache.org/tomcat-8.0-doc/config/host.html#Automatic_Application_Deployment
CIS Controls
v7:
- 5.1 Establish Secure Configurations
- Maintain documented, standard security configuration standards for all authorized operating systems and software.
Profile Applicability
- Level 2