检测到的漏洞修复方式一般分为两种:修改配置文件、升级组件规避漏洞,一般紧急规避是选择前一种方式。
1.tomcat隐藏版本信息
a. cd /usr/tomcat9/lib/
cp catalina.jar /usr/tomcat9/lib/catalina.jar.bk,将该文件拷贝并重命名为catalina.jar.bak作为备份
b. jar xf catalina.jar解压catalina.jar包,cd org/apache/catalina/util/,修改为
c.cd /usr/tomcat9/lib/
jar uvf catalina.jar org/apache/catalina/util/ServerInfo.properties.压缩修改后的catalina.jar包
cd /usr/tomcat9/bin/
FastGateServer.sh restart
./version.sh查看是否已经修改成功
2.替换错误页面
a.vi /usr/tomcat9/webapps/host-manager/WEB-INF/web.xml
b.在<error-page>下指定的error-code指定一个固定的.jsp文件,.jsp文件自定义放在
某个路径下即可
(操作见链接:https://blog.csdn.net/JustinQin/article/details/78879185)
3.修改http响应头(使其不使用X-XSS-Protection、X-Frame-Options、X-Content-Options:nosniff)
a.vi tomcat/conf/web.xml
b.增加如下配置:
<filter>
<filter-name>httpHeaderSecurity</filter-name>
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
<init-param>
<param-name>antiClickJackingOption</param-name>
<param-value>SAMEORIGIN</param-value>
</init-param>
<async-supported>true</async-supported>
</filter>
<filter-mapping>
<filter-name>httpHeaderSecurity</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
c.重启服务。再次F12查看请求头就可以看到请求头对这三个漏洞已经做了限制
总结:
X-XSS-Protection <===>设置X-XSS-Protection:1; mode=block
X-Frame-Options <===> 设置X-Frame-Options:SAMEORIGIN
X-Content-Options:nosniff <===>设置X-Content-Type-Options:nosniff
标签:catalina,tomcat,jar,cd,漏洞,usr,linux,Options,tomcat9 From: https://www.cnblogs.com/Alwayslearn/p/16844966.html