Lighttpd must not use symbolic links in the Lighttpd web content directory tree.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-89273 | VRAU-LI-000215 | SV-99923r1_rule | High |
| Description |
|---|
| A symbolic link allows a file or a directory to be referenced using a symbolic name raising a potential hazard if symbolic linkage is made to a sensitive area. When web scripts are executed and symbolic links are allowed, the Lighttpd could be allowed to access locations on the server that are outside the scope of the hosted application document root or home directory. |
| STIG | Date |
|---|---|
| VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide | 2018-10-12 |
Details
| Check Text ( C-88965r1_chk ) |
|---|
| At the command prompt, execute the following command: find /opt/vmware/share/htdocs -type l If any files are listed, this is a finding. |
| Fix Text (F-96015r1_fix) |
|---|
| At the command prompt, enter the following commands: Note: Replace unlink Repeat the commands for each file that was listed. |