tech-tomcat

An automated Tomcat security audit assesses administrative application exposure, AJP connector security, and version-specific vulnerabilities. It requires read-only HTTP access to the target host to identify misconfigurations in server.xml, web.xml, and JMX settings.

To check for the Ghostcat vulnerability (CVE-2020-1938), audit the Tomcat AJP connector configuration. The security assessment fingerprints the Tomcat version and evaluates AJP settings to detect susceptibility to this specific exploit.

Identifying exposed Tomcat Manager applications involves auditing administrative application exposure. This read-only security assessment scans production and development deployments to find publicly accessible interfaces that could allow unauthorized deployment or remote code execution.

A Tomcat security audit does not require write access. It performs a read-only assessment over HTTP, requiring only adherence to defined scope and authorization policies to evaluate TLS settings, JMX management, and directory listing configurations safely.

Evaluating Tomcat TLS and JMX security hardening involves checking server.xml and web.xml configurations. The assessment identifies insecure settings to ensure production environments follow security best practices against misconfigurations and unauthorized management access.

You can use an automated Tomcat audit for both production and development environments. It targets servlet containers across different deployment stages to identify default credentials, outdated versions, and insecure configurations comprehensively.