---
title: "WEB-TOM-003 Tomcat Shutdown Port Uses the Default Command"
canonical: https://openvapt.com/checks/WEB-TOM-003.html
html: https://openvapt.com/checks/WEB-TOM-003.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-TOM-003 Tomcat Shutdown Port Uses the Default Command

Checks whether Tomcat's shutdown port is enabled with the well-known default command SHUTDOWN.

- Domain: Web Apps
- Severity: Medium
- Control category: Secure Configuration
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
- CIS Controls v8: 16.7
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-1188
- OWASP Top 10 2021: A05:2021
- NIST SP 800-53 Rev. 5: CM-6, CM-7

## Why It Matters

Anyone who can connect to the shutdown port (8005 by default) and send the shutdown string stops Tomcat. With the default string, every local user and every compromised process on the machine can take the applications offline.

## How It Detects

Reads the <Server> element of conf/server.xml and fails when port is not -1 and the shutdown attribute is SHUTDOWN.

## How to Fix

Disable the port with <Server port="-1" ...> and stop Tomcat through systemd, or set shutdown to a long random string. Restart Tomcat.

## How to Verify

```
grep '<Server' <conf>/server.xml  shows port="-1".
```

## Learn the Theory

- [P13 Application Servers: Tomcat, Node.js and Python](https://openvapt.com/academy/p13.md)

## References

- [Apache Tomcat 10.1, Security Considerations](https://tomcat.apache.org/tomcat-10.1-doc/security-howto.html)
- [Apache Tomcat 10.1 Configuration Reference, The Server Component](https://tomcat.apache.org/tomcat-10.1-doc/config/server.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/tomcat.go

Run it: `openvapt scan --only WEB-TOM-003`. Read it offline: `openvapt explain WEB-TOM-003`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-TOM-003.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.