--- title: "P13: Application Servers: Tomcat, Node.js and Python" canonical: https://openvapt.com/academy/p13.html html: https://openvapt.com/academy/p13.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P13: Application Servers: Tomcat, Node.js and Python The recurring mistakes when Java, JavaScript and Python applications go to production: exposed app ports, debuggers, development servers, default credentials and unsupported runtimes. - Level: Practitioner - Time: about 30 minutes - Read first: P6 ## You Will Be Able To - Explain why application servers belong behind a reverse proxy, bound to loopback. - Recognise debuggers and development servers that give remote code execution. - Harden the Tomcat Manager, AJP connector and shutdown port, and Django's production settings. ## Behind the Proxy Tomcat (8080), Node.js (3000), Gunicorn or Django (8000) and PHP-FPM (9000) are meant to sit behind nginx or Apache. The proxy terminates TLS, adds security headers and absorbs slow clients. Binding them to 127.0.0.1 keeps those protections in front of every request. Some default ports are worse than unprotected websites. The Node.js inspector (9229), Tomcat AJP (8009), PHP-FPM FastCGI and Jupyter (8888) can all hand out code execution to whoever connects. ## Debuggers and Development Servers node --inspect opens the V8 debugger with no authentication. The Flask and Werkzeug debugger runs Python typed into an error page. Django with DEBUG = True prints source, settings and SQL on every error. manage.py runserver, flask run and python -m http.server are documented as not for production. In a systemd service, all of these show up in ExecStart= and Environment=, which is where OpenVAPT looks. ## Tomcat The Manager application deploys WAR files, so it is code execution behind a password. Limit it to localhost with a RemoteAddrValve or remove it. Never keep default users such as tomcat/s3cret in tomcat-users.xml. AJP is a trusted protocol with no user authentication. Ghostcat (CVE-2020-1938) read files through any reachable AJP port. Disable the connector, or bind it to loopback with a secret. Disable the shutdown port (port="-1") and delete the examples and docs applications. ## Runtimes Age Out Node.js release lines reach end of life on a published schedule; after that there are no security releases. Prefer even-numbered LTS lines and plan upgrades before the date, the same way as for the operating system and PHP. ## In Summary Application servers belong behind a reverse proxy on loopback. Remove default apps and credentials. Turn off debug mode and keep the runtime supported. ## Apply It - [NET-APP-001 Debugger or Application Control Ports Exposed](https://openvapt.com/checks/NET-APP-001.md) (high) - [NET-APP-002 Application Server Ports Reachable Without a Reverse Proxy](https://openvapt.com/checks/NET-APP-002.md) (medium) - [WEB-NODE-001 Node.js Version Past End of Life](https://openvapt.com/checks/WEB-NODE-001.md) (high) - [WEB-NODE-002 Node.js Debugger (Inspector) Enabled in a Service](https://openvapt.com/checks/WEB-NODE-002.md) (critical) - [WEB-NODE-003 Node.js Service Not Running in Production Mode](https://openvapt.com/checks/WEB-NODE-003.md) (low) - [WEB-PY-001 Django Debug Mode Enabled](https://openvapt.com/checks/WEB-PY-001.md) (high) - [WEB-PY-002 Django Accepts Any Host Header](https://openvapt.com/checks/WEB-PY-002.md) (medium) - [WEB-PY-003 Django Uses the Generated Development Secret Key](https://openvapt.com/checks/WEB-PY-003.md) (high) - [WEB-PY-004 Python Interactive Debugger Enabled in a Service](https://openvapt.com/checks/WEB-PY-004.md) (critical) - [WEB-PY-005 Python Development Server Used in a Service](https://openvapt.com/checks/WEB-PY-005.md) (medium) - [WEB-TOM-001 Tomcat Manager Reachable Without Address Restriction](https://openvapt.com/checks/WEB-TOM-001.md) (high) - [WEB-TOM-002 Tomcat Administrative Users With Default or Weak Passwords](https://openvapt.com/checks/WEB-TOM-002.md) (critical) - [WEB-TOM-003 Tomcat Shutdown Port Uses the Default Command](https://openvapt.com/checks/WEB-TOM-003.md) (medium) - [WEB-TOM-004 Tomcat AJP Connector Unprotected (Ghostcat)](https://openvapt.com/checks/WEB-TOM-004.md) (critical) - [WEB-TOM-005 Tomcat Example and Documentation Applications Deployed](https://openvapt.com/checks/WEB-TOM-005.md) (medium) ## Lab 1. `Run: openvapt demo --only NET-APP-,WEB-TOM-,WEB-NODE-,WEB-PY- --out p13` 2. `For each vulnerable service in internal/lab/fixtures_stacks.go, write the corrected ExecStart= and Environment= lines.` 3. `Read the Tomcat server.xml in both labs and explain what each of the three changes prevents.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. Why bind Gunicorn to 127.0.0.1:8000 instead of 0.0.0.0:8000? - A. It is faster - B. So every request passes through the hardened reverse proxy - C. Gunicorn requires it - D. It uses less memory - Answer: B. Loopback binding keeps the proxy's TLS, headers and slow-client protection in front of the app. 2. What does node --inspect=0.0.0.0:9229 give an attacker who can connect? - A. Read-only logs - B. The ability to run any JavaScript in the application - C. Nothing without a password - D. A list of running processes only - Answer: B. The inspector has no authentication. 3. What is the safest fix for an unused Tomcat AJP connector? - A. Change its port - B. Remove or comment out the connector - C. Add a firewall rule for port 80 - D. Bind it to 0.0.0.0 with a secret - Answer: B. A connector that does not exist cannot be attacked. If it is needed, bind it to loopback with a secret. 4. Which of these is documented as not for production? - A. Gunicorn behind nginx - B. manage.py runserver - C. nginx as a reverse proxy - D. A systemd service unit - Answer: B. Django's development server, flask run and python -m http.server are all documented as not for production. 5. Why is the Tomcat Manager application sensitive? - A. It deploys WAR files, so it is code execution behind a password - B. It only shows the Tomcat version - C. It only changes the log level - D. It serves static files - Answer: A. Anyone who logs in to the Manager can deploy and run code. Limit it to localhost or remove it. 6. What happens after a Node.js release line reaches end of life? - A. It gets security fixes for five more years - B. There are no more security releases - C. It becomes an LTS line - D. It is removed from servers automatically - Answer: B. End of life means no more security releases, so plan upgrades before the date. ## Key Terms - Reverse Proxy: A web server such as nginx or Apache that receives requests from the internet and forwards them to an application server listening on loopback. - Debug Mode: A development setting that shows internal details such as source code, settings and stack traces, and sometimes allows running code; it must be off in production. - Default Credentials: User names and passwords that ship with a product or appear in its documentation, which attackers try first. - End of Life: The date after which a product no longer receives security fixes from its maintainer. ## References - [Apache Tomcat, Security Considerations](https://tomcat.apache.org/tomcat-10.1-doc/security-howto.html) - [Django, Deployment checklist](https://docs.djangoproject.com/en/6.1/howto/deployment/checklist/) - [OWASP Node.js Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html) Offline: `openvapt learn P13`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p13.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.