ACCESS TO IT INTEL GRANTED

Disable Unnecessary Tomcat HTTP Methods and WebDAV Support

TARGET_ENV: Apache Tomcat 8.5+, 9.0+, 10.1+, 11.0+
[ TAGS: apache, snippet, tomcat, http-methods, webdav, trace, web.xml ]

Tomcat's default configuration allows the full range of HTTP methods defined by the Servlet specification, including PUT, DELETE, TRACE, and OPTIONS. WebDAV support, if enabled by the WebdavServlet, additionally exposes PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, and LOCK. These methods are rarely needed by typical web applications and expand the attack surface for file upload, cross-site tracing, and unauthorized modification. This snippet disables WebDAV by removing its servlet mapping from conf/web.xml and adds a security constraint that denies the TRACE method, which is used in Cross-Site Tracing (XST) attacks to bypass HttpOnly cookie protections.

Internally, the security constraint with an empty auth-constraint and a method-specific url-pattern causes the container to reject matching requests with 403 before reaching any servlet. The TRACE method is handled by the DefaultServlet unless explicitly blocked. For WebDAV, removing the WebdavServlet mapping prevents the servlet from being registered, so PROPFIND and friends return 404 or 405 depending on configuration.

Production use cases include any public-facing application, especially those handling authentication cookies where XST matters, and environments under PCI-DSS or CIS baselines that require disabling unused methods. Performance impact is zero. Common pitfalls include breaking legitimate REST APIs that rely on PUT or DELETE; scope the constraint to the exact methods you intend to block rather than blocking all non-GET/POST. Also verify that reverse proxies and WAFs are not re-enabling methods upstream. Test with curl -X TRACE and an OPTIONS request to confirm the method list returned.

> System.Execute()

<!-- conf/web.xml: block TRACE globally -->
<security-constraint>
  <web-resource-collection>
    <web-resource-name>Forbidden HTTP Methods</web-resource-name>
    <url-pattern>/*</url-pattern>
    <http-method>TRACE</http-method>
    <http-method>TRACK</http-method>
  </web-resource-collection>
  <auth-constraint />
</security-constraint>

<!-- Remove the WebDAV servlet mapping (comment out or delete) -->
<!--
<servlet-mapping>
  <servlet-name>webdav</servlet-name>
  <url-pattern>/webdav/*</url-pattern>
</servlet-mapping>
-->

# Verify TRACE is blocked
curl -s -o /dev/null -w '%{http_code}\n' -X TRACE http://localhost:8080/
# Expected: 403

# Verify OPTIONS response
curl -s -X OPTIONS -i http://localhost:8080/ | grep -i '^allow:'

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-1ADDC5E3D277

← BACK_TO_VAULT → CVE_DATABASE