The vCenter STS service DefaultServlet must be set to "readonly" for "PUT" and "DELETE" commands.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-258989	VCST-80-000130	SV-258989r934625_rule		Medium

Description
The default servlet (or DefaultServlet) is a special servlet provided with Tomcat that is called when no other suitable page is found in a particular folder. The DefaultServlet serves static resources as well as directory listings. The DefaultServlet is configured by default with the "readonly" parameter set to "true" where HTTP commands such as "PUT" and "DELETE" are rejected. Changing this to "false" allows clients to delete or modify static resources on the server and to upload new resources. DefaultServlet "readonly" must be set to "true", either literally or by absence (default).

Description

The default servlet (or DefaultServlet) is a special servlet provided with Tomcat that is called when no other suitable page is found in a particular folder. The DefaultServlet serves static resources as well as directory listings. The DefaultServlet is configured by default with the "readonly" parameter set to "true" where HTTP commands such as "PUT" and "DELETE" are rejected. Changing this to "false" allows clients to delete or modify static resources on the server and to upload new resources. DefaultServlet "readonly" must be set to "true", either literally or by absence (default).

STIG	Date
VMware vSphere 8.0 vCenter Appliance Secure Token Service (STS) Security Technical Implementation Guide	2023-10-29

Details

Check Text ( C-62729r934623_chk )
At the command prompt, run the following command: # xmllint --xpath "//[contains(text(), 'DefaultServlet')]/parent::" /usr/lib/vmware-sso/vmware-sts/conf/web.xml Example output: File servlet FileServlet org.apache.catalina.servlets.DefaultServlet If the "readOnly" param-value for the "DefaultServlet" servlet class is set to "false", this is a finding. If the "readOnly" param-value does not exist, this is not a finding.

Check Text ( C-62729r934623_chk )

At the command prompt, run the following command:

# xmllint --xpath "//*[contains(text(), 'DefaultServlet')]/parent::*" /usr/lib/vmware-sso/vmware-sts/conf/web.xml

Example output:

File servlet

FileServlet

org.apache.catalina.servlets.DefaultServlet

If the "readOnly" param-value for the "DefaultServlet" servlet class is set to "false", this is a finding.

If the "readOnly" param-value does not exist, this is not a finding.

Fix Text (F-62638r934624_fix)
Navigate to and open: /usr/lib/vmware-sso/vmware-sts/conf/web.xml Navigate to the ///org.apache.catalina.servlets.DefaultServlet/ node and remove the following node: readonly false Restart the service with the following command: # vmon-cli --restart sts