Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [tomcat]

The tag has no usage guidance.

2
votes
1answer
75 views

Does the CA have to be same for mutual authentication?

I'm trying to establish mutual authentication between my Tomcat server and my customer's firewall. The server certificate we have is from Digicert (Root CA) and RapidSSL (intermediate). The ...
0
votes
1answer
141 views

Tomcat application arbitrary file read exploitation

In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat. In ...
1
vote
1answer
72 views

Exfiltration through FTP using XXE on a Tomcat server

I'm trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I'm hosting two DTD's on Github Gist. These are their contents: Base XML (...
-1
votes
1answer
281 views

System Infected: Trojan.Naid Activity [closed]

We have Tomcat 6 in the production server with Symantec Endpoint Protection on windows server 2008 server datacenter. Symantec showing following lines in logs [SID: 27068] System Infected: Trojan....
1
vote
1answer
131 views

Is this parameter vulnerable to SQL Injection?

The backend server is running Tomcat 8.5 (Java backend). The URL in question is: https://website.com/application/servlet.do?currentOID=abc12300000000 I found that when I give an incomplete OID (i.e ...
1
vote
0answers
50 views

Are java bean oids predictable?

For example, I'm facing bean names such as "<3 CHAR PREFIX>" ex. "FIL000000AZB3Y" (random name) where FIL refers to a File object, and the 0000... is the OID. Is it possible to predict this, or is ...
2
votes
1answer
287 views

JBoss Web vulnerabilities [duplicate]

In my organization I found servers running JBoss Web/7.0.13.Final and JBoss Web/7.0.12.Final. I could not find security vulnerabilities for this server's versions, but they seem old to me. How can I ...
1
vote
1answer
66 views

What is the security risks of increasing the maximum number of HTTP parameter?

I want to increase the maximum number of HTTP parameters (maxParameterCount) from 10000 to 20000 in the Tomcat configuration: https://tomcat.apache.org/tomcat-8.5-doc/config/http.html What is the ...
0
votes
0answers
449 views

Host header injection attack with Spring boot embedded tomcat

Our application has been checked by PEN Test tool, and there are description of issue: An attacker can redirect the application using the host header on the below mentioned URL to redirect them ...
0
votes
0answers
382 views

No client cert sent with 2way SSL - Tomcat configuration

I'm trying to setup a client authentication (for mutual authentication) between 2 tomcats but at this point, I'm stuck with the thought that my client doesn't send its certificate. I have a private CA ...
2
votes
1answer
150 views

Why is CVE-2017-12617 considered a vulnerability?

CVE-2017-12617 is a remote code execution vulnerability via JSP upload. It requires the HTTP PUT method to be enabled on a vulnerable tomcat instance. Why is this considered a vulnerability and CVE ...
0
votes
1answer
293 views

Is TLS_ECDHE_RSA_WITH_RC4_128_SHA secure?

I was wondering whether TLS_ECDHE_RSA_WITH_RC4_128_SHA is secure. We have added it within the ciphers tag of the Tomcat configuration file.
5
votes
3answers
16k views

Using the openssl command, how can i tell if it's using TLS 1.0?

Due to a security scan, I was told to not use TLS1.0. I found a link that gave me commands to use to check if a specific protocol is used/enabled. The command I ran (with output is) (Output from ...
1
vote
1answer
156 views

Received weird request URL in my TOMCAT access logs

I have received some weird request URL in my TOMCAT access logs. which is as follows:- \x16\x03\x01\x01\"\x01" 200 40788 as clearly seen from above log, the server has given 200(success) response to ...
1
vote
0answers
3k views

Only Enable TLSv1.2 on Tomcat 6.0.36

I need to make sure that a web app running on Tomcat 6.0.36 with Java 1.8 is only using TLS 1.2 As per documentation, I tried adjusting the Connector section in server.xml: sslProtocol="TLSv1.2" (I ...
1
vote
0answers
186 views

Encrypting File System Data at Rest on Windows Web Application

We have a web application (running in Apache Tomcat on a Windows Server 2008 machine) that stores most of its data in the file system. We are investigating ways to implement encryption for this data ...
1
vote
0answers
38 views

TLS: Using different signature algorithms for ca and server certificate [duplicate]

I've the following scenario: Root-CA: key algorithm is RSA-2048 and it's self-signed (Sha256WithRSA) Server-Cert: key algorithm is ECDSA, based on secp384r1 and it's signed by Root-CA with ...
0
votes
1answer
277 views

Access encrypted files (dm-crypt/LUKS) through web app

I'm a newbie to encryption issues and I'm trying to sort out a few questions. For a distributed application we need to deploy a server outside of our company with sensitives PDF files on it. That ...
0
votes
1answer
241 views

Apache Mod_Proxy Remote Negative Content-Length Buffer Overflow Vulnerability

We have a Windows Server 2012 R2 running Apache 2.2.27 and Apache tomcat8 version 1.0.15.0. Can you guys shed a few words on what the vulnerability is and also how to re-mediate this with the two ...
0
votes
1answer
3k views

Tomcat War Payload not working

So I am currently working my way through a few books. One of which had me download the metasploitable2 vm. This machine has a tomcat server running on it which I successfully exploited using ...
2
votes
1answer
550 views

Sanitize 3rd party XSS post in Java API

We have some RESTful API services that we have been using for several years. Recently we have started considering surfacing these to 3rd party clients so they can write their own UIs and we can work ...
-1
votes
1answer
473 views

How to choose ECDH and ECDHE with curve more than 192 in Tomcat

I am using tomcat server, where I came across a situation where the TestSSLServer tool reports the below. Highly appreciate your expertise in recommending a solution to the finding where I can choose ...
0
votes
1answer
2k views

Is Tomcat session ID generation FIPS compliant?

I am trying to achieve the following security rule server must generate a unique session identifier using a FIPS 140-2 approved random number generator. I am using Tomcat 7.0.68 for my server, I am ...
0
votes
2answers
833 views

SSL certificate for server authentication

to clear my understandings: I create self signed certificate first keytool -genkey -alias mysign -keyalg RSA -keystore mykeystorename.jks the firstname of the self sign has to be my domain name? ...
1
vote
1answer
83 views

What are the implication of having Apache Tomcat servlets available publicly?

While testing a website which had Apache Tomcat running, I came across a directory called "Examples" which contained "Servlet Examples", "JSP Examples" and "Websocket Examples". What do you think are ...
0
votes
0answers
1k views

JSP shell in the image on Tomcat

I have the server running Tomcat/7.0.52 under Ubuntu. I'm trying to create an image with JSP shell. I wrote the shell like this: <%@ page import="java.io.*" %> <%@ page import="java.util.*" ...
0
votes
0answers
49 views

Tomcat hacked and war deployed - How can I secure the server [duplicate]

today we discovered that the server of one of our customers was hacked so I would like to know what to do to secure the server. It's a windows Server 2008 machine. We have not responsability on the ...
0
votes
1answer
89 views

Is it a breach to have a ssh program into a tomcat server

I start to working in a project here and find something that at least seems odd to me. Since I'm not an specialist I came here to ask. It is a Java Web project that was made to run into a Tomcat ...
2
votes
1answer
717 views

Does TrustManager PKIX (or RFC 3280/X.509) really check client certificate expiration date?

It was noticed that default java implementation of TrustManagerFactory for PKIX trust manager algorithm (X509ExtendedTrustManager) doesn't really check expiration date of client's certificate during ...
1
vote
3answers
694 views

Is it necessary to update JRE in an Apache Tomcat Server?

We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42. Users have expressed their concerns about Java 7's support/updates being ...
1
vote
2answers
3k views

What algorithm should I use to avoid the error “ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY”?

I got a CA cert by submitting my CSR from GoDaddy, after applying a certificate to my Tomcat web server. When I access my website using Chrome or Mozilla I face the error: ...
3
votes
1answer
10k views

Creating an TLS certificate using keytool with SHA-256

I want to create a TLS certificate for my personal tomcat8 webserver on a Debian ARM server. I've done this before, using the following command: /usr/bin/keytool -genkey -alias tomcat -keyalg RSA -...
9
votes
3answers
4k views

Does the recommended course of action for preventing Logjam on Tomcat servers really eliminate all risks of weak DH keys?

Can anyone verify this fix secures against the Logjam vulnerability for Apache Tomcat? I'm sceptical about it's effectiveness, since it doesn't mention how to implement the user defined 2048 bit DH ...
14
votes
5answers
22k views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...