The vCenter VAMI service must have Web Distributed Authoring (WebDAV) disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259145	VCLD-80-000034	SV-259145r935339_rule		Medium

Description
A web server can be installed with functionality that, by its nature, is not secure. WebDAV is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors. WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.

Description

A web server can be installed with functionality that, by its nature, is not secure. WebDAV is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors. WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.

STIG	Date
VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) Security Technical Implementation Guide	2023-10-29

Details

Check Text ( C-62885r935337_chk )
At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null\|awk '/server\.modules/,/\)/'\|grep mod_webdav If any value is returned, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Check Text ( C-62885r935337_chk )

At the command prompt, run the following command:

# /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null|awk '/server\.modules/,/\)/'|grep mod_webdav

If any value is returned, this is a finding.

Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details:

https://kb.vmware.com/s/article/2100508

Fix Text (F-62794r935338_fix)
Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Delete or comment out the "mod_webdav" line. Note: The line may be in an included config and not in the parent config itself. Restart the service with the following command: # vmon-cli --restart applmgmt