Apache Tomcat
SoftwareWikipedia
17
MENTIONS
7
EPISODES
7
PODCASTS
Search complete. 17 mentions across 7 episodes found for "Apache Tomcat".
Oct 22, 2026
R. Prescott StearnsHOST
So a fact could be like, I found this specific server.
speaker_1HOST
Yeah, a fact could be target domain runs Apache Tomcat version 8.5 or discovered an exposed API endpoint handling user authentication.
speaker_1HOST
Got it.
R. Prescott StearnsHOST
So it's conducting automated, highly structured reconnaissance and documenting the environment dynamically.
Network ChuckHOST
I've done a few things, like I've spun up, I've done OpenVPN in a Debian box, and I've played with the Raspberry Pi, which is Linux-based, So I think it's very important to learn it and become very familiar with it because I think, I forget where I read it, but you can look it up right now.
Network ChuckHOST
Majority of the world's servers, web servers, are running off Linux, off of Tomcat, Red Hat.
Network ChuckHOST
That's how things are now.
Network ChuckHOST
Many companies are Linux only.
Gerald AugerHOST
It doesn't happen all the time, but sometimes there'll be a project that was like popular.
Gerald AugerHOST
Like let's say like, I don't know, frigging Apache Tomcat, right? Just to pick one.
Gerald AugerHOST
Uh, and let's just say it gets abandoned.
Gerald AugerHOST
Well, everybody still knows it.
Gerald AugerHOST
If it's abandoned, someone else can pick it up as like the new maintainer, and sometimes threat actors do that and then weaponize it and they just...
Gerald AugerHOST
Everybody trusts it 'cause it's like, oh, Apache Tomcat's been around forever.
Gerald AugerHOST
And then, you know, they get a, a, a basically a massive rash going.
Gerald AugerHOST
All right, so what, what's actually happening here is that, uh, if you do have, um, an NPM, uh, package, according to Microsoft it says, "Your configuration becomes validated and exempt from expiration after its first successful publish.
speaker_0HOST
The sources call out the color picker plugin, so like slash includes slash jQuery slash plugins slash colorpicker slash images slash, and then a trailing slash at the end.
speaker_1HOST
That trailing slash is the catalyst because in systems like Apache Tomcat, which, you know, handles the web requests for these Java apps, a trailing slash can alter how the routing logic maps an endpoint.
speaker_0HOST
Oh, interesting.
speaker_1HOST
Yeah.
speaker_1HOST
So when the attacker appends that slash, Tomcat treats the preceding string as a directory, bypassing those strict endpoint mapping rules.
speaker_1HOST
That gives an unauthenticated attacker the ability to reach sensitive files anywhere in the application route.
speaker_0HOST
Which sounds terrifying, but I have to push back a little on the practical execution of this because the sources note that the attacker cannot actually browse the directory, right?
speaker_1HOST
You have to pull these instances off the public internet immediately if they don't explicitly require public access.
James AzarHOST
Patch those now, and if you can't, restrict external network access, even on some of your internet faces, facing instances that require a login.
James AzarHOST
And you should apply Atlassian's temporary migrations like WAF or proxy rules, blocking to traversal, the traversal patterns, and Tomcat rewrite valve rules or URL rewrite rules for Bitbucket.
James AzarHOST
Cover every cluster node, including Bitbucket mirrors and mirror farm nodes, then review access logs for those traversal patterns.
James AzarHOST
That's gonna be really important there.
![[Dev]olution](https://particle.news/cdn-cgi/image/format=auto,width=128/https://cdn.particle.pro/url/media/7e33e3db-fcc5-58eb-a77f-9b7c5c466bc5/39a026b401bed59e7db5213b0033f9b346c6805d6aa31df79245026157078a44)
Marc CluetGUEST
It's really easy to contribute to the open source community, and you just need to want to do it and to find something that you can actually solve.
Marc CluetGUEST
By reducing the amount of choices, you make those choices better, right? And again, we're talking about 30 ways to install Java, right? If we make that one single way to install a JDK, one single way to install Tomcat, that single way will have all the bells, whistles, checks, balances, monitoring, traces, everything that you need.
Marc CluetGUEST
Right? And it will be feature-rich, it will be a good experience where you can just enable exactly what you need.
Marc CluetGUEST
And then I equate that to the Michelin star of that code in the sense that it's something when you go to a Michelin-star restaurant, you go there for the food, but you go there for the years of experience that that chef had trying to make that filet mignon better, and they spent 10, 15 years of their life obsessed in making sure that that was the best, right? So I'm trying to reduce that in a shorter time, make sure that that's the best that you can get.
Nicky PikeHOST
So where do you think the line is between giving AI too many choices and giving it so few that you're actually kind of limiting what AI is gonna be able to do for you?
Marc CluetGUEST
So I would say it's the same as monoliths based off microservices, right? You need to reduce the problem.
Marc CluetGUEST
So going back to the Tomcat example, right? There's 50 different flags that you can have for Tomcat and install Tomcat anywhere in the world, right? With the m-m-amount of memory, with the libraries that it supports, with the metrics libraries that it can integrate, et cetera, et cetera.
Marc CluetGUEST
And if you tell AI, "Build me something to automatically install Tomcat that has everything," it will do a bad job.
Adam BienHOST
Uh, this could be just dropped because, you know, there were class loader issues or whatever.
Adam BienHOST
And, um, e- even simple stuff, like if you would use Tomcat, and I remember Log4j, what sometimes happen if you're not careful, that the log, uh, statements appear twice because the singleton was loaded twice, right?
Andrzej GrzesikGUEST
[laughs]
Adam BienHOST
So, and s- so I, I had ...