← Back to Omnissa Horizon Connection Server Security Technical Implementation Guide

V-286760

CAT II (Medium)

The Horizon Connection Server must enable the Content Security Policy (CSP).

Rule ID

SV-286760r1291662_rule

STIG

Omnissa Horizon Connection Server Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000366

Discussion

The Horizon Connection Server CSP feature mitigates a broad class of content injection vulnerabilities, including cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context. The connection server defines the policy and the client browser enforces the policy. This feature is enabled by default but must be validated and maintained over time.

Check Content

If the "HTTP(S) Secure Tunnel" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.

1. On the Horizon Connection Server, navigate to:

<install_directory>\sslgateway\conf

Note: "<install_directory>" defaults to "%PROGRAMFILES%\Omnissa\Horizon\Server" unless changed during installation.

2. Verify the file "locked.properties" exists.

If the "locked.properties" file does not exist, this is a finding.

3. Open "locked.properties" in a text editor.

If there is no "enableCSP" setting, this is not a finding.

If "enableCSP" is present and set to "false", this is a finding.

Fix Text

If the "HTTP(S) Secure Tunnel" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.

1. On the Horizon Connection Server, navigate to:

<install_directory>\sslgateway\conf

2. Open the "locked.properties" file in a text editor or create it if it does not exist.

3. Remove the following line:

enableCSP=false

4. Save and close the file. 

5. Restart the Omnissa Horizon Connection Server service for changes to take effect.