ESX Agent Manager must have mappings set for Java servlet pages.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-256685	VCEM-70-000013	SV-256685r888611_rule		Medium

Description
Resource mapping is the process of tying a particular file type to a process in the web server that can serve that type of file to a requesting client and identify which file types are not to be delivered to a client. By not specifying which files can and cannot be served to a user, the web server could deliver to a user web server configuration files, log files, password files, etc. Because Tomcat is a Java-based web server, the main file extension used is .jsp. This check ensures the .jsp file type has been properly mapped to servlets.

Description

Resource mapping is the process of tying a particular file type to a process in the web server that can serve that type of file to a requesting client and identify which file types are not to be delivered to a client. By not specifying which files can and cannot be served to a user, the web server could deliver to a user web server configuration files, log files, password files, etc. Because Tomcat is a Java-based web server, the main file extension used is *.jsp. This check ensures the *.jsp file type has been properly mapped to servlets.

STIG	Date
VMware vSphere 7.0 vCenter Appliance EAM Security Technical Implementation Guide	2023-06-15

Details

Check Text ( C-60360r888609_chk )
At the command prompt, run the following command: # xmllint --format /usr/lib/vmware-eam/web/webapps/eam/WEB-INF/web.xml \| sed 's/xmlns="."//g' \| xmllint --xpath '/web-app/servlet-mapping/servlet-name[text()="JspServlet"]/parent::servlet-mapping' - Expected result: JspServlet .jsp If the output of the command does not match the expected result, this is a finding.

Fix Text (F-60303r888610_fix)
Navigate to and open: /usr/lib/vmware-eam/web/webapps/eam/WEB-INF/web.xml Navigate to and locate the mapping for the JSP servlet. It is the node that contains JspServlet. Configure the node to look like the code snippet below: JspServlet *.jsp Restart the service with the following command: # vmon-cli --restart eam