The vCenter UI service must be configured to limit data exposure between applications.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259112	VCUI-80-000057	SV-259112r935240_rule		Medium

Description
If RECYCLE_FACADES is true or if a security manager is in use, a new facade object will be created for each request. This reduces the chances that a bug in an application might expose data from one request to another.

STIG	Date
VMware vSphere 8.0 vCenter Appliance User Interface (UI) Security Technical Implementation Guide	2023-10-29

Details

Check Text ( C-62852r935238_chk )
At the command line, run the following command: # grep RECYCLE_FACADES /usr/lib/vmware-vsphere-ui/server/conf/catalina.properties Example result: org.apache.catalina.connector.RECYCLE_FACADES=true If "org.apache.catalina.connector.RECYCLE_FACADES" is not set to "true", this is a finding. If the "org.apache.catalina.connector.RECYCLE_FACADES" setting does not exist, this is not a finding.

Fix Text (F-62761r935239_fix)
Navigate to and open: /usr/lib/vmware-vsphere-ui/server/conf/catalina.properties Update or remove the following line: org.apache.catalina.connector.RECYCLE_FACADES=true Restart the service with the following command: # vmon-cli --restart vsphere-ui