The WebSphere Application Server plug-in is not specified in accordance with the proper security requirements.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-225622 | ZWAS0050 | SV-225622r1146196_rule | CCI-000382 | medium |
| Description | ||||
| Requests processed by the WebSphere Application Server (WAS) are dependent on directives configured in the HTTP server httpd.conf file. These directives specify critical files containing the WAS plug-in and WAS configuration. These files provide the operational and security characteristics of WAS. Failure to properly configure WAS-related directives could lead to undesirable operations and degraded security. This exposure may compromise the availability and integrity of applications and customer data. | ||||
| STIG | Date | |||
| zOS WebSphere Application Server for TSS Security Technical Implementation Guide | 2025-09-28 | |||
Details
Check Text (C-225622r1146196_chk)
Refer to the following report produced by the z/OS Data Collection:
- USSCMDS.RPT(AHTTPD).
Collect the following information for each IBM HTTP server:
- The JCL procedure library and member name used to start each IBM HTTP server. DOC(IHSPROCS).
For each IBM HTTP server, supply the following information:
- Web server ID defined to the ACP.
- Web server administration group defined to the ACP.
- Web server standard HFS directory.
Review the HTTP server JCL procedure to determine the httpd.conf file to review.
Ensure that all WAS-related directives are configured using the ServerInit, Service, and ServerTerm statements as outlined below.
The following path entries were added to the /etc/httpd.conf file for WebSphere 3.5:
ServerInit /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:init_exit /usr/lpp/WebSphere/etc/WebSphere/AppServer/properties/was.conf
Service /webapp/examples/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.jhtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.shtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /servlet/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.jsp /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
ServerTerm /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:term_exit
The following path entries are added to the /etc/httpd.conf file for WebSphere 4.0.1:
ServerInit - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:init_exit
Service - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:service_exit
ServerTerm - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:term_exit
Note: The /etc/WebSphere clause for ServerInit matches the directory name above where the site customization was.conf file was established.
Specific items to review include proper path, was.conf, and plug-in settings.
If all WAS-related directives are configured properly, this is not a finding.
Fix Text (F-27311r1146195_fix)
The ISSO will ensure that the WebSphere Application Server directives in the httpd.conf file are configured as outlined below.
Ensure that all WAS-related directives are configured using the ServerInit, Service, and ServerTerm statements as outlined below.
The following path entries were added to the /etc/httpd.conf file for WebSphere 3.5:
ServerInit /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:init_exit /usr/lpp/WebSphere/etc/WebSphere/AppServer/properties/was.conf
Service /webapp/examples/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.jhtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.shtml /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /servlet/* /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit
Service /*.jsp /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:service_exit ServerTerm /usr/lpp/WebSphere/AppServer/bin/was350plugin.so:term_exit
The following path entries are added to the /etc/httpd.conf file for WebSphere 4.0.1:
ServerInit -/usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:init_exit
Service - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:service_exit
ServerTerm - /usr/lpp/WebSphere401/WebServerPlugIn/bin/was400plugin.so:term_exit
Note: The /etc/WebSphere clause for ServerInit matches the directory name above where the site customization was.conf file was established. Specific items to review include proper path, was.conf, and plug-in settings.