V-240242

Discussion

Resource mapping is the process of tying a particular file type to a process in Lighttpd that can serve that type of file to a requesting client and to identify which file types are not to be delivered to a client. Lighttpd provides the url.access-deny parameter to specify a blacklist of file types which should be denied.

Check Content

Obtain supporting documentation from the ISSO.

Determine the file types (blacklist) that are deemed for denial. 
 
Note: Lighttpd provides the url.access-deny parameter to specify the blacklist of files.

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf file

Navigate to the url.access-deny parameter.

If url.access-deny parameter is not configured with the file types that are blacklisted, this is a finding.

If url.access-deny parameter is not set properly, this is a finding.