ESX Agent Manager must not enable support for TRACE requests.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-256699	VCEM-70-000027	SV-256699r888653_rule		Medium

Description
"TRACE" is a technique for a user to request internal information about Tomcat. This is useful during product development but should not be enabled in production. Allowing an attacker to conduct a TRACE operation against ESX Agent Manager will expose information that would be useful to perform a more targeted attack. ESX Agent Manager provides the "allowTrace" parameter as means to disable responding to TRACE requests.

Description

"TRACE" is a technique for a user to request internal information about Tomcat. This is useful during product development but should not be enabled in production. Allowing an attacker to conduct a TRACE operation against ESX Agent Manager will expose information that would be useful to perform a more targeted attack. ESX Agent Manager provides the "allowTrace" parameter as means to disable responding to TRACE requests.

STIG	Date
VMware vSphere 7.0 vCenter Appliance EAM Security Technical Implementation Guide	2023-06-15

Details

Check Text ( C-60374r888651_chk )
At the command prompt, run the following command: # grep allowTrace /usr/lib/vmware-eam/web/conf/server.xml If "allowTrace" is set to "true", this is a finding. If no line is returned, this is not a finding.

Fix Text (F-60317r888652_fix)
Navigate to and open: /usr/lib/vmware-eam/web/conf/server.xml Locate and navigate to 'allowTrace="true"'. Remove the 'allowTrace="true"' setting. Restart the service with the following command: # vmon-cli --restart eam