Ensure Web Server Document Root does not contain information that should be private

HighLevel 1Manual reviewwebsphere

Description

WAR files contain servable content. The Web container will serve any files found in the root(Web Server Document Root) of the WAR file. This is fine as long as you place only servable content in the root. Thus, you should never place content that shouldn't be shown to users in the root of the WAR. For example, don't put property files, class files, or other important information there. If you must place such information in the WAR file, place it within the WEB-INF directory, as permitted by the servlet specification. Information there is never served by the Web. TMAegis cannot evaluate this reliably, so it is reported as a manual review item with the audit steps.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Ensure that there is no content that shouldn't be shown to users in the root of the WAR. For example, check for property files, class files, or other important information.

How it is fixed

Fix method: Guidance or infrastructure patch

Remove all content that shouldn't be shown to users in the root of the WAR. For example, relocate property files, class files, or other important information within the WEB-INF directory, as permitted by the servlet specification.

Properties

Operating systems: Any
Tags: webspheremanual-review
Reference: CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.4.15 Ensure Web Server Document Root does not contain information that should be private