The vCenter ESX Agent Manager service DefaultServlet must be set to "readonly" for "PUT" and "DELETE" commands.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-259022 | VCEM-80-000130 | SV-259022r934724_rule | CCI-000213 | medium |
| Description | ||||
| The default servlet (or DefaultServlet) is a special servlet provided with Tomcat that is called when no other suitable page is found in a particular folder. The DefaultServlet serves static resources as well as directory listings. The DefaultServlet is configured by default with the "readonly" parameter set to "true" where HTTP commands such as "PUT" and "DELETE" are rejected. Changing this to "false" allows clients to delete or modify static resources on the server and to upload new resources. DefaultServlet "readonly" must be set to "true", either literally or by absence (default). | ||||
| STIG | Date | |||
| VMware vSphere 8.0 vCenter Appliance ESX Agent Manager (EAM) Security Technical Implementation Guide | 2023-10-29 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
AC-3
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.1.1
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.1.2
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000213
1.00
- DISA · V1R1 · disa_xccdf · related
Details
Check Text (C-259022r934724_chk)
At the command prompt, run the following command:
# xmllint --xpath "//*[contains(text(), 'DefaultServlet')]/parent::*" /usr/lib/vmware-eam/web/webapps/eam/WEB-INF/web.xml
Example output:
<servlet>
<description>File servlet</description>
<servlet-name>FileServlet</servlet-name>
<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
</servlet>
If the "readOnly" param-value for the "DefaultServlet" servlet class is set to "false", this is a finding.
If the "readOnly" param-value does not exist, this is not a finding.
Fix Text (F-62671r934723_fix)
Navigate to and open:
/usr/lib/vmware-eam/web/webapps/eam/WEB-INF/web.xml
Navigate to the /<web-apps>/<servlet>/<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>/ node and remove the following node:
<init-param>
<param-name>readonly</param-name>
<param-value>false</param-value>
</init-param>
Restart the service with the following command:
# vmon-cli --restart eam