Tomcat 8.5 WEB-INF内容可访问URL

Question

I am having a security issue with tomcat 8.5 application WEB-INF contents. I am not suppose to able to access content of WEB-INF (ie web.xml)via url but I can seem to access. How do I restrict this access? I thought it should be restricted out the box. I am using linux and the permission is rw for user and r for group.

Any suggestion is appreciated.

Answer 1

Normally, files under /WEB-INF are not accessible directly from outside. If the files can be accessible, your application has vulnerabilities, like path traversal. A simple solution is, for example, to restrict the access to URLs including WEB-INF by Apache in front of Tomcat.