UCF STIG Viewer Logo

vSphere UI must restrict its cookie path.


Overview

Finding ID Version Rule ID IA Controls Severity
V-256795 VCUI-70-000018 SV-256795r889384_rule Medium
Description
Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie, may contain session information and user credentials used to maintain a persistent connection between the user and the hosted application since HTTP/HTTPS is a stateless protocol. vSphere UI is bound to the "/ui" virtual path behind the reverse proxy, and its cookies are configured as such. This configuration must be confirmed and maintained.
STIG Date
VMware vSphere 7.0 vCenter Appliance UI Security Technical Implementation Guide 2023-02-21

Details

Check Text ( C-60470r889382_chk )
At the command prompt, run the following command:

# xmllint --format /usr/lib/vmware-vsphere-ui/server/conf/context.xml | xmllint --xpath '/Context/@sessionCookiePath' -

Expected result:

sessionCookiePath="/ui"

If the output does not match the expected result, this is a finding.
Fix Text (F-60413r889383_fix)
Navigate to and open:

/usr/lib/vmware-vsphere-ui/server/conf/context.xml

Add the following configuration to the node:

sessionCookiePath="/ui"

Example:



Restart the service with the following command:

# vmon-cli --restart vsphere-ui