Apache Tomcat Default Files

Tenable plugin 12085 fires when a remote Apache Tomcat instance still serves default content such as the ROOT landing page, default error page, documentation, or example JSP/servlet paths. This is not version-bound: any Tomcat deployment, including embedded or vendor-bundled Tomcat, can trigger if those default assets are still reachable.

The vendor's MEDIUM label is technically understandable for unauthenticated information disclosure, but operationally it is too high for a 10,000-host patch queue. In the real world this finding is usually reconnaissance fuel, not a compromise primitive: it leaks versioning and demo content that can help an attacker choose a follow-on path, but it still requires a second weakness such as an exposed management app, weak credentials, or a separate Tomcat/application CVE to become dangerous.

Why this verdict

• Start at Tenable's 5.3: the vendor scores this like a generic unauthenticated information disclosure.
• Downward adjustment for no exploit primitive: default files do not by themselves deliver RCE, auth bypass, or direct data theft; they mostly leak version and environment clues.
• Downward adjustment for chain dependency: meaningful impact usually requires a second condition such as exposed /manager or /host-manager, weak credentials, or a separate Tomcat/application CVE.
• Downward adjustment for exposure reality: many enterprise Tomcat instances sit behind reverse proxies, app front ends, or hardened images that already hide or remove the default content.
• Not IGNORE because recon still matters: on an internet-facing Tomcat service, stock examples and default error pages shorten attacker enumeration and can materially help a follow-on attack.

Why not higher?

This is not a one-click compromise. There is no direct integrity or availability impact demonstrated by the plugin, and even the confidentiality impact is usually limited to versioning, paths, and demo behavior. For a higher rating, the finding would need to prove reachable admin functionality, weak/default credentials, or a concrete exploitable CVE on the same host.

Why not lower?

It is still a real externally observable weakness, not pure cosmetic noise. Apache's own security guidance says unused default webapps should be removed, and examples should always be removed from security-sensitive installations because they can aid an attacker. On internet-facing Tomcat, this is enough to keep it above IGNORE.

1. Remove default webapps — Delete or exclude examples, docs, and unused ROOT content from Tomcat images and installs. For a LOW verdict there is no SLA; treat this as backlog hygiene and complete it in the next routine hardening cycle, especially first on internet-facing assets.
2. Replace default error pages — Serve custom 404/500 responses at the reverse proxy or app tier so Tomcat does not disclose stock error pages or version clues. Again, for LOW there is no mitigation SLA; fold this into your normal web hardening workstream.
3. Lock down management interfaces — Ensure /manager and /host-manager are either removed, bound to localhost, or restricted with IP allowlists and strong auth. This is not required to clear plugin 12085, but it prevents the recon from turning into a real compromise path.
4. Suppress easy fingerprinting — Review reverse-proxy and Tomcat headers, banners, and default content so version and product details are not handed out for free. This is a hygiene task, not an emergency patch, unless another Tomcat exploit is in play.
5. Rebuild embedded Tomcat packages — For products that ship embedded Tomcat, adjust the application image or vendor-supported package layout to exclude demo content rather than trying to 'patch' Tomcat. There is no fixed version for this finding, so packaging control is the durable answer.

Run this from an auditor workstation or CI job that can reach the target URL over HTTP/S. Invoke it as python3 tomcat_default_files_check.py https://app.example.com:8443; no local privileges are required, and it reports VULNERABLE, PATCHED, or UNKNOWN based on remote content checks.

#!/usr/bin/env python3
# tomcat_default_files_check.py
# Remote check for Apache Tomcat default files / default error pages.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE

import sys
import ssl
import urllib.request
import urllib.error
from urllib.parse import urljoin

TIMEOUT = 10
HEADERS = {
    'User-Agent': 'noisgate-tomcat-default-files-check/1.0'
}

INDICATORS = [
    'Apache Tomcat',
    'Tomcat Examples',
    'Tomcat Documentation',
    'HTTP Status 404',
    'HTTP Status 500',
    'If you\'re seeing this',
    'The requested resource',
]

PATHS = [
    '/',
    '/examples/',
    '/examples/jsp/',
    '/examples/servlets/',
    '/docs/',
    '/this-path-should-not-exist-noisgate-404-test'
]


def fetch(url):
    req = urllib.request.Request(url, headers=HEADERS)
    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT, context=ssl.create_default_context()) as resp:
            body = resp.read(65536).decode('utf-8', errors='ignore')
            return resp.getcode(), body, dict(resp.headers)
    except urllib.error.HTTPError as e:
        try:
            body = e.read(65536).decode('utf-8', errors='ignore')
        except Exception:
            body = ''
        return e.code, body, dict(e.headers)
    except Exception as e:
        return None, str(e), {}


def has_indicator(text, headers):
    haystack = text + '\n' + '\n'.join([f'{k}: {v}' for k, v in headers.items()])
    return [i for i in INDICATORS if i.lower() in haystack.lower()]


def normalize_base(base):
    if not base.startswith('http://') and not base.startswith('https://'):
        base = 'http://' + base
    if not base.endswith('/'):
        base += '/'
    return base


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 tomcat_default_files_check.py <base_url>')
        sys.exit(3)

    base = normalize_base(sys.argv[1])
    findings = []
    reachable = False

    for path in PATHS:
        url = urljoin(base, path.lstrip('/')) if path != '/' else base
        code, body, headers = fetch(url)
        if code is None:
            continue
        reachable = True
        hits = has_indicator(body, headers)
        if hits:
            findings.append({
                'url': url,
                'status': code,
                'hits': hits[:5]
            })

    if not reachable:
        print('UNKNOWN - target unreachable or TLS/HTTP request failed for all probes')
        sys.exit(2)

    if findings:
        print('VULNERABLE - default Tomcat content or Tomcat-generated error pages detected')
        for f in findings:
            print(f"  {f['status']} {f['url']} -> {', '.join(f['hits'])}")
        sys.exit(1)

    print('PATCHED - no default Tomcat content detected in tested paths')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Tenable Nessus Plugin 12085 Overview
2. Tenable Nessus Plugin 12085 Changelog
3. Apache Tomcat 9 Security Considerations
4. Apache Tomcat 9 Manager App How-To
5. Apache Tomcat 11 Host Manager App How-To
6. OWASP Secure by Default Guidance
7. GreyNoise: Coordinated Brute Force Activity Targeting Apache Tomcat Manager
8. Broadcom: Tomcat default files scan warning