Address a Tomcat Default Files Scan Finding – Xerox DocuShare Support

Audience: DocuShare administrators

Applies to DocuShare 7.7, 8.0, and 8.1 on Windows. This guidance is based on a reviewed DocuShare 7.7 environment running Windows Server 2019.

New installations of DocuShare 8.1 already include both server.xml settings described in this article, so no change is needed. A system upgraded to DocuShare 8.1 from an earlier release should be checked for both settings, because the change is part of the template used for new installations.

A vulnerability scan may report that default Tomcat files are installed and could reveal information about the server. The finding groups several different items together; in DocuShare, assess each item separately.

Reported Finding

The default error page, default index page, example JSPs and/or example servlets are installed on the remote Apache Tomcat server. These files should be removed as they may help an attacker uncover information about the remote Tomcat install or host itself.

How the Finding Applies to DocuShare

Example JSPs and servlets: On Windows, the Tomcat example, documentation, manager, and host-manager applications are not included in the DocuShare installation, so they are not present on a DocuShare server. This part of the finding does not apply.
Default index page: DocuShare does not use the Tomcat welcome page. It replaces the root index page with a redirect to the DocuShare home page. However, Tomcat's release notes file (RELEASE-NOTES.txt) remains in the root folder and states the Tomcat version. The steps in this article do not remove that file, so this part of the finding applies only in part.
Default error page: This part of the finding applies. In the reviewed environment, Tomcat error pages display the Tomcat version. The settings below remove the version and the error details from Tomcat error pages and set the Server response header to a fixed value.

Suppress the Tomcat Version on Error Pages

1. Stop DocuShare.

2. Back up tomcat\conf\server.xml before editing it.

3. In server.xml, add the following attribute to the HTTP Connector element, the Connector with protocol="HTTP/1.1" (port 8080 by default). Do not add it to the AJP Connector (protocol="AJP/1.3"):

server="DocuShare"

4. Inside the Host element in the same file, add this Valve:

5. Save server.xml and start DocuShare.

After this change, Tomcat error pages no longer display the Tomcat version or error details. The valve setting showServerInfo="false" removes the version, and showReport="false" removes the error details.

The server attribute sets the Server response header to the fixed value DocuShare. Tomcat does not return its version in that header by default, so this setting does not remove a version; it standardizes the header.

These settings do not replace the Tomcat error page with a custom error page, so a scanner may still report the default error page item. This change has not been tested against a specific scanner.

Important: No DocuShare or Tomcat patch adds these two settings to an existing server.xml file. Applying a patch alone therefore does not change this scan result; apply the configuration change directly to server.xml.

Scope

These steps address the Tomcat version disclosure on error pages and the Server response header value. They do not remove the Tomcat release notes file from the root folder, and they do not establish that other scanner findings are resolved. This article covers Windows installations. For Linux installations, or if the scan reports additional issues or your Tomcat configuration has been customized, review the findings with DocuShare Support.