STIGQter: STIG Summary: MarkLogic Server v9 Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 24 Oct 2024:

MarkLogic Server, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.

DISA Rule

SV-220366r961038_rule

Vulnerability Number

V-220366

Group Title

SRG-APP-000175-DB-000067

Rule Version

ML09-00-003900

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Weight

10

Fix Recommendation

Organizations must develop a strategy for maintaining a record of CRLs that have been applied to MarkLogic as well as a strategy for regularly obtaining updated CRLs from applicable Certificate Authorities.

Use one of the following two methods to add a CRL to MarkLogic:

Option 1 - Use the MarkLogic REST API "PUT /manage/v2/certificate-revocation-lists" (requires user authenticating to the system and have security and manage-admin roles)
Using a compatible HTTP request generator (i.e., Postman or curl) construct an HTTP PUT request:
EXAMPLE:
curl -X PUT --anyauth --user admin:admin --header "Content-Type:text/html" \
-d "http://crl.verisign.com/pca3.crl" \
http://localhost:8002/manage/v2/certificate-revocation-lists?url=url
NOTE: If the "url" param is a CRL then the request body must contain the PEM- or DER-encoded CRL. If the "url" parameter is a URL, then the request body must contain the URL from which the CRL was downloaded.

Option 2 - Use the Query Console in MarkLogic to insert the CRL using pki:insert-certificate-revocation-list() method (requires user authenticating to the system have security and manage-admin roles)
EXAMPLE:
xquery version "1.0-ml";
import module namespace pki = "http://marklogic.com/xdmp/pki" at "/MarkLogic/pki.xqy";
let $URI := "http://crl.verisign.com/pca3.crl"
return
pki:insert-certificate-revocation-list(
$URI,
xdmp:document-get($URI)/binary() )

Check Contents

Review DBMS configuration to verify that certificates being accepted by the DBMS are validated by performing RFC 5280-compliant certification path validation, specifically periodic revocation list processing, with custom application code that performs these functions.

To check for existing CRLs, use the MarkLogic QConsole and execute the following XQuery command against the Security Database:

cts:uri-match("http://marklogic.com/xdmp/pki/crls/*")

If there are CRLs, then it will return which CRLs are loaded, if not then it will return an empty sequence.

If any required CRLs are missing, this is a finding.

Vulnerability Number

V-220366

Documentable

False

Rule Version

ML09-00-003900

Severity Override Guidance

Review DBMS configuration to verify that certificates being accepted by the DBMS are validated by performing RFC 5280-compliant certification path validation, specifically periodic revocation list processing, with custom application code that performs these functions.

To check for existing CRLs, use the MarkLogic QConsole and execute the following XQuery command against the Security Database:

cts:uri-match("http://marklogic.com/xdmp/pki/crls/*")

If there are CRLs, then it will return which CRLs are loaded, if not then it will return an empty sequence.

If any required CRLs are missing, this is a finding.

Check Content Reference

M

Target Key

4064