Detections
Analytics

VCST-67-000009 - The Security Token Service must only run one web app.

Information

VMware ships the Security Token Service on the VCSA with one web app, in ROOT.war. Any other .war file is potentially malicious and must be removed.

Solution

For each unexpected file returned in the check, run the following command:

# rm /usr/lib/vmware-sso/vmware-sts/webapps/<NAME>.war

Restart the service with the following command:

# service-control --restart vmware-stsd

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_STIG.zip

Item Details

References: CAT|II, CCI|CCI-001749, Rule-ID|SV-239660r679052_rule, STIG-ID|VCST-67-000009, Vuln-ID|V-239660

Plugin: Unix

Control ID: 92be698ad437af628b4d7e140867faa350796e0900d5910c6590dd0363403da8