The system must not provide root/administrator level access to CIM-based hardware monitoring tools or other third-party applications.

From VMware vSphere ESXi 6.0 Security Technical Implementation Guide

Part of SRG-OS-000480-VMM-002000

Associated with: CCI-000366

SV-77799r1_rule The system must not provide root/administrator level access to CIM-based hardware monitoring tools or other third-party applications.

Vulnerability discussion

The CIM system provides an interface that enables hardware-level management from remote applications via a set of standard APIs. Create a limited-privilege, read-only service account for CIM. Grant this role to the user on the ESXi server. Place this user in the Exception Users list. When/where write access is required, create/enable a limited-privilege, service account and grant only the minimum required privileges.

Check content

If the CIM account does not exist, this check is not applicable. If write access is required, this check is not applicable. From the vSphere client, select the ESXi host, and go to "Permissions". Select the CIM account user, then right-click and select properties to verify read-only access. If write access is not required and the access level is not "read-only", this is a finding.

Fix text

From the vSphere client, select the ESXi host; go to "Local Users and Groups". Create a limited-privileged, read-only service account for CIM. Place the CIM account into the "root" group. Select Users and right-click in the user screen. Select "Add", then Add a new user. If write access is required only grant the minimum required privileges. CIM accounts should be limited to the "Host >> Config >> System Management" and "Host >> CIM >> CIMInteraction" privileges.

Pro Tips

Powered by sagemincer