JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide

The JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide (V2 R6) has 67 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

67STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R6

CurrentPublished Wed Apr 02 2025

Any unapproved applications must be removed.

JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide

Assessment Title

Rule Text

Any unapproved applications must be removed.

Description

Discussion Text

Extraneous services and applications running on an application server expands the attack surface and increases risk to the application server. Securing any server involves identifying and removing any unnecessary services and, in the case of an application server, unnecessary and/or unapproved applications.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-213524

Rule

SV-213524r960963_rule

Severity

medium

Rule Version

JBOS-AS-000250

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Log on to the OS of the JBoss server with OS permissions that allow access to JBoss. 
Using the relevant OS commands and syntax, cd to the <JBOSS_HOME>/bin/ folder. 
Run the jboss-cli script. 
Connect to the server and authenticate. 
Run the command:

ls /deployment

The list of deployed applications is displayed.  Have the system admin identify the applications listed and confirm they are approved applications.

If the system admin cannot provide documentation proving their authorization for deployed applications, this is a finding.

Implementation Procedure

Fix Text

Identify, authorize, and document all applications that are deployed to the application server.  Remove unauthorized applications.

STIG check 31 of 67 in the JBoss Enterprise Application Platform 6.3 STIG checklist

← Previous · V-213523Welcome Web Application must be disabled.Next · V-213525 →JBoss application and management ports must be approved by the PPSM CAL.