The vCenter Perfcharts service DefaultServlet must be set to "readonly" for "PUT" and "DELETE" commands.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-259090	SRG-APP-000033-AS-000024	VCPF-80-000130	SV-259090r960792_rule	2024-07-11	2

Description
The default servlet (or DefaultServlet) is a special servlet provided with Tomcat that is called when no other suitable page is found in a particular folder. The DefaultServlet serves static resources as well as directory listings. The DefaultServlet is configured by default with the "readonly" parameter set to "true" where HTTP commands such as PUT and DELETE are rejected. Changing this to "false" allows clients to delete or modify static resources on the server and to upload new resources. DefaultServlet "readonly" must be set to "true", either literally or by absence (default).

Description

The default servlet (or DefaultServlet) is a special servlet provided with Tomcat that is called when no other suitable page is found in a particular folder. The DefaultServlet serves static resources as well as directory listings. The DefaultServlet is configured by default with the "readonly" parameter set to "true" where HTTP commands such as PUT and DELETE are rejected. Changing this to "false" allows clients to delete or modify static resources on the server and to upload new resources. DefaultServlet "readonly" must be set to "true", either literally or by absence (default).

ℹ️ Check
At the command prompt, run the following command: # xmllint --xpath "//[contains(text(), 'DefaultServlet')]/parent::" /usr/lib/vmware-perfcharts/tc-instance/webapps/statsreport/WEB-INF/web.xml Example output: <servlet> <description>File servlet</description> <servlet-name>FileServlet</servlet-name> <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class> </servlet> If the "readOnly" param-value for the "DefaultServlet" servlet class is set to "false", this is a finding. If the "readOnly" param-value does not exist, this is not a finding.

ℹ️ Check

At the command prompt, run the following command: # xmllint --xpath "//*[contains(text(), 'DefaultServlet')]/parent::*" /usr/lib/vmware-perfcharts/tc-instance/webapps/statsreport/WEB-INF/web.xml Example output: <servlet> <description>File servlet</description> <servlet-name>FileServlet</servlet-name> <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class> </servlet> If the "readOnly" param-value for the "DefaultServlet" servlet class is set to "false", this is a finding. If the "readOnly" param-value does not exist, this is not a finding.

✔️ Fix
Navigate to and open: /usr/lib/vmware-perfcharts/tc-instance/webapps/statsreport/WEB-INF/web.xml Navigate to the /<web-apps>/<servlet>/<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>/ node and remove the following node: <init-param> <param-name>readonly</param-name> <param-value>false</param-value> </init-param> Restart the service with the following command: # vmon-cli --restart perfcharts

✔️ Fix

Navigate to and open: /usr/lib/vmware-perfcharts/tc-instance/webapps/statsreport/WEB-INF/web.xml Navigate to the /<web-apps>/<servlet>/<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>/ node and remove the following node: <init-param> <param-name>readonly</param-name> <param-value>false</param-value> </init-param> Restart the service with the following command: # vmon-cli --restart perfcharts