UCF STIG Viewer Logo

ESX Agent Manager must not enable support for TRACE requests.


Overview

Finding ID Version Rule ID IA Controls Severity
V-239396 VCEM-67-000025 SV-239396r717040_rule Medium
Description
"Trace" is a technique for a user to request internal information about Tomcat. This is useful during product development but should not be enabled in production. Allowing an attacker to conduct a Trace operation against ESX Agent Manager will expose information that would be useful to perform a more targeted attack. ESX Agent Manager provides the "allowTrace" parameter to disable responding to Trace requests.
STIG Date
VMware vSphere 6.7 EAM Tomcat Security Technical Implementation Guide 2022-01-03

Details

Check Text ( C-42629r674680_chk )
At the command prompt, execute the following command:

# grep allowTrace /usr/lib/vmware-eam/web/conf/server.xml

If "allowTrace" is set to "true", this is a finding.

If no line is returned, this is NOT a finding.
Fix Text (F-42588r674681_fix)
Navigate to and open:

/usr/lib/vmware-eam/web/conf/server.xml

Navigate to and locate:

'allowTrace="true"'

Remove the 'allowTrace="true"' setting.