Application Servers: Tomcat, Node.js and Python

Behind the Proxy

Tomcat (8080), Node.js (3000), Gunicorn or Django (8000) and PHP-FPM (9000) are meant to sit behind nginx or Apache. The proxy terminates TLS, adds security headers and absorbs slow clients. Binding them to 127.0.0.1 keeps those protections in front of every request. Some default ports are worse than unprotected websites. The Node.js inspector (9229), Tomcat AJP (8009), PHP-FPM FastCGI and Jupyter (8888) can all hand out code execution to whoever connects.

Debuggers and Development Servers

node --inspect opens the V8 debugger with no authentication. The Flask and Werkzeug debugger runs Python typed into an error page. Django with DEBUG = True prints source, settings and SQL on every error. manage.py runserver, flask run and python -m http.server are documented as not for production. In a systemd service, all of these show up in ExecStart= and Environment=, which is where OpenVAPT looks.

Tomcat

The Manager application deploys WAR files, so it is code execution behind a password. Limit it to localhost with a RemoteAddrValve or remove it. Never keep default users such as tomcat/s3cret in tomcat-users.xml. AJP is a trusted protocol with no user authentication. Ghostcat (CVE-2020-1938) read files through any reachable AJP port. Disable the connector, or bind it to loopback with a secret. Disable the shutdown port (port="-1") and delete the examples and docs applications.

Runtimes Age Out

Node.js release lines reach end of life on a published schedule; after that there are no security releases. Prefer even-numbered LTS lines and plan upgrades before the date, the same way as for the operating system and PHP.

In Summary

Application servers belong behind a reverse proxy on loopback. Remove default apps and credentials. Turn off debug mode and keep the runtime supported.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only NET-APP-,WEB-TOM-,WEB-NODE-,WEB-PY- --out p13
2. For each vulnerable service in internal/lab/fixtures_stacks.go, write the corrected ExecStart= and Environment= lines.
3. Read the Tomcat server.xml in both labs and explain what each of the three changes prevents.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• Apache Tomcat, Security Considerations
• Django, Deployment checklist
• OWASP Node.js Security Cheat Sheet

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P13: Application Servers: Tomcat, Node.js and Python (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p13.html

@misc{openvapt_p13,
  author       = {{OpenVAPT}},
  title        = {{P13: Application Servers: Tomcat, Node.js and Python}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p13.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}