The Security Token Service must not enable support for TRACE requests.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-256769	VCST-70-000025	SV-256769r889277_rule		Medium

Description
"TRACE" is a technique for a user to request internal information about Tomcat. This is useful during product development but should not be enabled in production. Allowing an attacker to conduct a TRACE operation against the Security Token Service will expose information that would be useful to perform a more targeted attack. The Security Token Service provides the "allowTrace" parameter as means to disable responding to TRACE requests.

Description

"TRACE" is a technique for a user to request internal information about Tomcat. This is useful during product development but should not be enabled in production. Allowing an attacker to conduct a TRACE operation against the Security Token Service will expose information that would be useful to perform a more targeted attack. The Security Token Service provides the "allowTrace" parameter as means to disable responding to TRACE requests.

STIG	Date
VMware vSphere 7.0 vCenter Appliance STS Security Technical Implementation Guide	2023-02-21

Details

Check Text ( C-60444r889275_chk )
At the command prompt, run the following command: # grep allowTrace /usr/lib/vmware-sso/vmware-sts/conf/server.xml If "allowTrace" is set to "true", this is a finding. If no line is returned, this is not a finding.

Fix Text (F-60387r889276_fix)
Navigate to and open: /usr/lib/vmware-sso/vmware-sts/conf/server.xml Locate and remove the 'allowTrace="true"' setting. Restart the service with the following command: # vmon-cli --restart sts