ESX Agent Manager must not enable support for TRACE requests.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239396	VCEM-67-000025	SV-239396r717040_rule		Medium

Description
"Trace" is a technique for a user to request internal information about Tomcat. This is useful during product development but should not be enabled in production. Allowing an attacker to conduct a Trace operation against ESX Agent Manager will expose information that would be useful to perform a more targeted attack. ESX Agent Manager provides the "allowTrace" parameter to disable responding to Trace requests.

Description

"Trace" is a technique for a user to request internal information about Tomcat. This is useful during product development but should not be enabled in production. Allowing an attacker to conduct a Trace operation against ESX Agent Manager will expose information that would be useful to perform a more targeted attack. ESX Agent Manager provides the "allowTrace" parameter to disable responding to Trace requests.

STIG	Date
VMware vSphere 6.7 EAM Tomcat Security Technical Implementation Guide	2022-01-03

Details

Check Text ( C-42629r674680_chk )
At the command prompt, execute the following command: # grep allowTrace /usr/lib/vmware-eam/web/conf/server.xml If "allowTrace" is set to "true", this is a finding. If no line is returned, this is NOT a finding.

Fix Text (F-42588r674681_fix)
Navigate to and open: /usr/lib/vmware-eam/web/conf/server.xml Navigate to and locate: 'allowTrace="true"' Remove the 'allowTrace="true"' setting.