V-240241

Discussion

Lighttpd will only allow or deny script execution based on file extension. The ability to control script execution is controlled with the cgi.assign variable in lighttpd.conf. For script mappings, the ISSO must document and approve all allowable file extensions the web site allows (whitelist). The whitelist will be compared to the script mappings in Lighttpd.

Check Content

Obtain supporting documentation from the ISSO.

Determine the scripts that are deemed necessary and approved (whitelist). 

Note: Lighttpd provides the cgi.assign parameter to specify script mappings.

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf file

Navigate to the cgi.assign parameter.

If cgi.assign parameter is configured with script types that are deemed for denial, this is a finding.