← Back to VMware vSphere 8.0 vCenter Appliance Lookup Service Security Technical Implementation Guide

V-259056

CAT II (Medium)

The vCenter Lookup service DefaultServlet must be set to "readonly" for "PUT" and "DELETE" commands.

Rule ID

SV-259056r934826_rule

STIG

VMware vSphere 8.0 vCenter Appliance Lookup Service Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000213

Discussion

The default servlet (or DefaultServlet) is a special servlet provided with Tomcat that is called when no other suitable page is found in a particular folder. The DefaultServlet serves static resources as well as directory listings. The DefaultServlet is configured by default with the "readonly" parameter set to "true" where HTTP commands such as "PUT" and "DELETE" are rejected. Changing this to "false" allows clients to delete or modify static resources on the server and to upload new resources. DefaultServlet "readonly" must be set to "true", either literally or by absence (default).

Check Content

At the command prompt, run the following command:

# xmllint --xpath "//*[contains(text(), 'DefaultServlet')]/parent::*" /usr/lib/vmware-lookupsvc/conf/web.xml

Example output:

<servlet>
      <description>File servlet</description>
      <servlet-name>FileServlet</servlet-name>
      <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
</servlet>

If the "readOnly" param-value for the "DefaultServlet" servlet class is set to "false", this is a finding.

If the "readOnly" param-value does not exist, this is not a finding.

Fix Text

Navigate to and open:

/usr/lib/vmware-lookupsvc/conf/web.xml

Navigate to the /<web-apps>/<servlet>/<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>/ node and remove the following node:

<init-param>
      <param-name>readonly</param-name>
      <param-value>false</param-value>
</init-param>

Restart the service with the following command:

# vmon-cli --restart lookupsvc