The application server management interface must provide a logout capability for user-initiated communication session.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-57403	SRG-APP-000296-AS-000201	SV-71675r2_rule		Medium

Description
If a user cannot explicitly end an application server management interface session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. The attacker will then have access to the application server management functions without going through the user authentication process. To prevent this type of attack, the application server management interface must close user sessions when defined events are met and provide a logout function for users to explicitly close the session and free resources that were in use by the user.

Description

If a user cannot explicitly end an application server management interface session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. The attacker will then have access to the application server management functions without going through the user authentication process. To prevent this type of attack, the application server management interface must close user sessions when defined events are met and provide a logout function for users to explicitly close the session and free resources that were in use by the user.

STIG	Date
Application Server Security Requirements Guide	2018-01-08

Details

Check Text ( C-58077r1_chk )
Review application server documentation and configuration settings to determine if the application server management interface provides a logout capability. If the application server management interface does not provide a logout capability, this is a finding.

Fix Text (F-62441r1_fix)
Configure the application server management interface to provide a logout capability for the users.