Lighttpd must not use symbolic links in the Lighttpd web content directory tree.

From VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide

Associated with: CCI-000381

SV-99923r1_rule Lighttpd must not use symbolic links in the Lighttpd web content directory tree.

Vulnerability discussion

A symbolic link allows a file or a directory to be referenced using a symbolic name raising a potential hazard if symbolic linkage is made to a sensitive area. When web scripts are executed and symbolic links are allowed, the Lighttpd could be allowed to access locations on the server that are outside the scope of the hosted application document root or home directory.

Check content

At the command prompt, execute the following command: find /opt/vmware/share/htdocs -type l If any files are listed, this is a finding.

Fix text

At the command prompt, enter the following commands: Note: Replace for the name of any files that were returned. unlink Repeat the commands for each file that was listed.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.