Remove vulnerability "Apache Tomcat Default Files" from an AKS container

Question

Need to remove vulnerability "Apache Tomcat Default Files" from an AKS container where we use "tomcat:9-jdk8" base image.

Solution to remove it is provided at "https://www.tenable.com/plugins/nessus/12085".

Please let me know how can I enter into a AKS container and delete those files?

Thanking you in advance.

Answer 1

Hello @Pratim Das, Partha C ,

You can run the below commands using Azure Portal Cloud Shell to login to the container and delete required files. If you want to use local system , make sure to install az cli cmd-lets and kubectl depending upon your environment (windows/linux)

1) Get the access credentials for the required aks cluster
-> az aks get-credentials -g <AKSResourceGroup> -n <AKSClusterName>

2) Get the pod name on which your container is running
-> kubectl get pods ( It will list out all the running pods )

3) If you have multiple containers running on that Pod , you can list all the container names using the below command
-> kubectl get pod <PodName> -o jsonpath='{.spec.containers[*].name}' (It will output all the container names)

4) ****To login to the particular container****
-> kubectl exec -it <PodName> -c <ContainerName> /bin/bash
-> If you have only one container running on that Pod , you can directly use the command
kubectl exec -it <PodName> /bin/bash

5) After Step4 , you are in the container and you can remove the required files

Answer 2

Hello @Pratim Das, Partha C ,
It seems the original question was answered right ? If yes - Can you kindly "Accept the Answer" - so that It will help be beneficial to community.

Regarding the follow-up :
Can you kindly give more details like :
1) What error message you got
2) What operations you were trying out ?

I just tried deploying the same image tomcat:9-jdk8 into AKS container

kubectl exec -it apache-tomcat-84d6d58bf5-pdgpm -- /bin/bash
root@apache-tomcat-84d6d58bf5-pdgpm:/usr/local/tomcat# ls -a
. .. CONTRIBUTING.md LICENSE NOTICE README.md RELEASE-NOTES RUNNING.txt bin conf lib logs native-jni-lib temp webapps webapps.dist work

As per the article https://www.tenable.com/plugins/nessus/12085 , they are asking to remove default error page, default index page, example JSPs and/or example servlets

Example you can search for those files like below:-

root@apache-tomcat-84d6d58bf5-pdgpm:/usr/local/tomcat# find -type f -name "default*"
./webapps.dist/docs/default-servlet.html

Before deletion , I would suggest to follow-up with Apache community team mentioned in that article.
Try this troubleshooting : https://cwiki.apache.org/confluence/display/TOMCAT/Troubleshooting+and+Diagnostics

Also couple of security vulnerabilities mentioned here as well:- https://tomcat.apache.org/security.html