STIGQter: STIG Summary: VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Sep 2018:

tc Server VCO must be configured with a cross-site scripting (XSS) filter.

DISA Rule

SV-100725r1_rule

Vulnerability Number

V-90075

Group Title

SRG-APP-000246-WSR-000149

Rule Version

VRAU-TC-000600

Severity

CAT II

CCI(s)

• CCI-001094 - The information system restricts the ability of individuals to launch organization-defined denial of service attacks against other information systems.

Weight

10

Fix Recommendation

Navigate to and open /etc/vco/app-server/web.xml.

Configure a <filter> node with the below configuration:

<filter>
<filter-name>xssfilter</filter-name>
<filter-class>com.vmware.vcops.ui.util.XssFilter</filter-class>

<init-param>
<!-- Comma separated list of URLs that will be sanitized by this filter -->
<param-name>fileIncludes</param-name>
<param-value>/vcops/services/api.js,/vcops/services/api-debug.js,/vcops/services/api-debug-doc.js</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>xssfilter</filter-name>
<url-pattern>/vcops/services/*</url-pattern>
</filter-mapping>

Check Contents

At the command prompt, execute the following command:

grep -B 2 -A 7 XssFilter /etc/vco/app-server/web.xml

If the XSS filter is not present, this is a finding.

Vulnerability Number

V-90075

Documentable

False

Rule Version

VRAU-TC-000600

Severity Override Guidance

At the command prompt, execute the following command:

grep -B 2 -A 7 XssFilter /etc/vco/app-server/web.xml

If the XSS filter is not present, this is a finding.

Check Content Reference

M

Target Key

3439

Comments