tc Server HORIZON must not use the tomcat-users XML database for user management.

From VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide

Associated with: CCI-000381

SV-100651r1_rule tc Server HORIZON must not use the tomcat-users XML database for user management.

Vulnerability discussion

User management and authentication can be an essential part of any application hosted by the web server. Along with authenticating users, the user management function must perform several other tasks like password complexity, locking users after a configurable number of failed logons, and management of temporary and emergency accounts; and all of this must be done enterprise-wide.For historical reasons, tc Server contains a tomcat-users.xml file in the configuration directory. This file was originally used by standalone applications that did not authenticate against an LDAP or other enterprise mechanism. vRA does not use this file.

Check content

At the command prompt, execute the following command: cat /opt/vmware/horizon/workspace/conf/tomcat-users.xml If "tomcat-users.xml" file contains any user information, this is a finding.

Fix text

Contact the ISSO and/or SA. Determine why user data is being stored in "tomcat-users.xml". If the user data is not required then it should be removed. The vRA appliance does not maintain user data in this file by default.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.