Lookup Service must not enable support for TRACE requests.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-256730	VCLU-70-000025	SV-256730r888781_rule		Medium

Description
"TRACE" is a technique for a user to request internal information about Tomcat. This is useful during product development but should not be enabled in production. Allowing an attacker to conduct a TRACE operation against the service will expose information that would be useful to perform a more targeted attack. Lookup Service provides the "allowTrace" parameter as means to disable responding to TRACE requests.

Description

"TRACE" is a technique for a user to request internal information about Tomcat. This is useful during product development but should not be enabled in production. Allowing an attacker to conduct a TRACE operation against the service will expose information that would be useful to perform a more targeted attack. Lookup Service provides the "allowTrace" parameter as means to disable responding to TRACE requests.

STIG	Date
VMware vSphere 7.0 vCenter Appliance Lookup Service Security Technical Implementation Guide	2023-02-21

Details

Check Text ( C-60405r888779_chk )
At the command prompt, run the following command: # grep allowTrace /usr/lib/vmware-lookupsvc/conf/server.xml If "allowTrace" is set to "true", this is a finding. If no line is returned, this is not a finding.

Fix Text (F-60348r888780_fix)
Navigate to and open: /usr/lib/vmware-lookupsvc/conf/server.xml Locate and navigate to 'allowTrace="true"'. Remove the 'allowTrace="true"' setting. Restart the service with the following command: # vmon-cli --restart lookupsvc