Check: VCLD-67-000021
VMware vSphere 6.7 VAMI-lighttpd STIG:
VCLD-67-000021
(in versions v1 r3 through v1 r2)
Title
VAMI must not have the Web Distributed Authoring (WebDAV) servlet installed. (Cat II impact)
Discussion
A web server can be installed with functionality that, by its nature, is not secure. WebDAV is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors. WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.
Check Content
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/server\.modules/,/\)/'|grep mod_webdav If any value is returned, this is a finding.
Fix Text
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Delete or comment out the "mod_webdav" line. The line may be in an included config and not in the parent config.
Additional Identifiers
Rule ID: SV-239729r879587_rule
Vulnerability ID: V-239729
Group Title: SRG-APP-000141-WSR-000085
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000381 |
The organization configures the information system to provide only essential capabilities. |
Controls
Number | Title |
---|---|
CM-7 |
Least Functionality |