STIGQter: STIG Summary: JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

Network access to HTTP management must be disabled on domain-enabled application servers not designated as the domain controller.

DISA Rule

SV-213538r615939_rule

Vulnerability Number

V-213538

Group Title

SRG-APP-000316-AS-000199

Rule Version

JBOS-AS-000470

Severity

CAT II

CCI(s)

• CCI-002322 - The organization provides the capability to expeditiously disconnect or disable remote access to the information system within the organization-defined time period.

Weight

10

Fix Recommendation

Run the <JBOSS_HOME>/bin/jboss-cli command line interface utility.
Connect to the JBoss server and run the following command.
/core-service=management/management-interface=httpinterface/:write-attribute(name=console-enabled,value=false)

Successful command execution returns
{"outcome" => "success"}, and future attempts to access the management console via web browser at <SERVERNAME>:9990 will result in no access to the admin console.

Check Contents

Log on to each of the JBoss domain member servers.

Note: Sites that manage systems using the JBoss Operations Network client require HTTP interface access. It is acceptable that the management console alone be disabled rather than disabling the entire interface itself.

Run the <JBOSS_HOME>/bin/jboss-cli command line interface utility and connect to the JBoss server.
Run the following command:
ls /core-service=management/management-interface=httpinterface/

If "console-enabled=true", this is a finding.

Vulnerability Number

V-213538

Documentable

False

Rule Version

JBOS-AS-000470

Severity Override Guidance

Log on to each of the JBoss domain member servers.

Note: Sites that manage systems using the JBoss Operations Network client require HTTP interface access. It is acceptable that the management console alone be disabled rather than disabling the entire interface itself.

Run the <JBOSS_HOME>/bin/jboss-cli command line interface utility and connect to the JBoss server.
Run the following command:
ls /core-service=management/management-interface=httpinterface/

If "console-enabled=true", this is a finding.

Check Content Reference

M

Target Key

3987

Comments