tc Server API must be configured with a cross-site scripting (XSS) filter.

From VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide

Associated with: CCI-001094

SV-99641r1_rule tc Server API must be configured with a cross-site scripting (XSS) filter.

Vulnerability discussion

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.As a web server, tc Server can be vulnerable to XSS if steps are not taken to mitigate the threat. VMware provides the XssFilter component to provide a layer of defense against XSS. Filters are Java objects that performs filtering tasks on either the request to a resource (a servlet or static content), or on the response from a resource, or both.

Check content

At the command prompt, execute the following command: grep -B 2 -A 7 XssFilter /usr/lib/vmware-vcops/tomcat-enterprise/webapps/suite-api/WEB-INF/web.xml If the XSS filter is not present and there is no result returned, then this is a finding.

Fix text

Navigate to and open /usr/lib/vmware-vcops/tomcat-enterprise/webapps/suite-api/WEB-INF/web.xml. Configure a node with the below configuration: xssfilter com.vmware.vcops.ui.util.XssFilter fileIncludes /vcops/services/api.js,/vcops/services/api-debug.js,/vcops/services/api-debug-doc.js xssfilter /vcops/services/*

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.