← Back to VMware Horizon 7.13 Connection Server Security Technical Implementation Guide

V-246909

CAT II (Medium)

The Horizon Connection Server must enable the Content Security Policy.

Rule ID

SV-246909r879887_rule

STIG

VMware Horizon 7.13 Connection Server Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-000366

Discussion

The Horizon Connection Server Content Security Policy (CSP) feature mitigates a broad class of content injection vulnerabilities, such as cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context. The Connection Server defines the policy and the client browser enforces the policy. This feature is enabled by default but must be validated and maintained over time.

Check Content

On the Horizon Connection Server, navigate to "<install_directory>\VMware\VMware View\Server\sslgateway\conf".

If a file named "locked.properties" does not exist in this path, this is NOT a finding.

Open "locked.properties" in a text editor. Find the "enableCSP" setting.

If there is no "enableCSP" setting, this is NOT a finding.

If "enableCSP" is set to "false", this is a finding.

Fix Text

On the Horizon Connection Server, navigate to "<install_directory>\VMware\VMware View\Server\sslgateway\conf".

Open "locked.properties" in a text editor. Remove the following line:

enableCSP=false

Save and close the file. Restart the "VMware Horizon View Connection Server" service for changes to take effect.