STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

Users in the REST API admin role must be authorized.

DISA Rule

SV-250326r1137578_rule

Vulnerability Number

V-250326

Group Title

SRG-APP-000033-AS-000024

Rule Version

IBMW-LS-000050

Severity

CAT I

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

If an admin user exists in either a basic user registry or a quickstartsecurity registry, edit the ${server.config.dir}/server.xml file and remove the basic registry and/or quickstartsecurity registry settings.

If an admin user exists via an LDAP user registry setting, document and approve the user(s) or group that have been assigned to the admin role and ensure anyone granted REST API admin rights is authorized.

LDAP EXAMPLE:
<administrator-role>
<user>cn=bob,o=ibm,c=us</user>
</administrator-role>

BASIC REGISTRY EXAMPLE:
<basicRegistry>
<user name="bob" password="bobpassword"/>
<user name="joe" password="joepassword"/>
<group name="group1" ...>
</group>
</basicRegistry>

<administrator-role>
<user>bob</user>
<group>group1</group>
</administrator-role>

QUICKSTARTSECURITY EXAMPLE:
<featureManager>
<feature>restConnector-2.0</feature>
</featureManager>
<quickStartSecurity userName="bob" userPassword="bobpassword" />
<keyStore id="defaultKeyStore" password="keystorePassword"/>

Check Contents

As a user with access to ${server.config.dir}/server.xml, review the file and look for the admin role settings.

grep -i administrator-role ${server.config.dir}/server.xml
grep -i quickstartsecurity ${server.config.dir}/server.xml

If the admin role has been created, users in that role must be documented and approved. However, using the basic registry or the quickstartsecurity methods are not acceptable. The preferred user registry method is to use a centralized access control method via LDAP.

If no admin users exist at all, this is not a finding.

If admin users in an LDAP user registry configuration are not documented and approved, this is a finding.

If admin users exist in a basic user registry configuration, or in a quickstartsecurity user configuration, this is a finding.

LDAP EXAMPLE:
<administrator-role>
<user>cn=bob,o=ibm,c=us</user>
</administrator-role>

BASIC REGISTRY EXAMPLE:
<basicRegistry>
<user name="bob" password="bobpassword"/>
<user name="joe" password="joepassword"/>
<group name="group1" ...>
</group>
</basicRegistry>

<administrator-role>
<user>bob</user>
<group>group1</group>
</administrator-role>

QUICKSTARTSECURITY EXAMPLE:
<featureManager>
<feature>restConnector-2.0</feature>
</featureManager>
<quickStartSecurity userName="bob" userPassword="bobpassword" />
<keyStore id="defaultKeyStore" password="keystorePassword"/>

Vulnerability Number

V-250326

Documentable

False

Rule Version

IBMW-LS-000050

Severity Override Guidance

As a user with access to ${server.config.dir}/server.xml, review the file and look for the admin role settings.

grep -i administrator-role ${server.config.dir}/server.xml
grep -i quickstartsecurity ${server.config.dir}/server.xml

If the admin role has been created, users in that role must be documented and approved. However, using the basic registry or the quickstartsecurity methods are not acceptable. The preferred user registry method is to use a centralized access control method via LDAP.

If no admin users exist at all, this is not a finding.

If admin users in an LDAP user registry configuration are not documented and approved, this is a finding.

If admin users exist in a basic user registry configuration, or in a quickstartsecurity user configuration, this is a finding.

LDAP EXAMPLE:
<administrator-role>
<user>cn=bob,o=ibm,c=us</user>
</administrator-role>

BASIC REGISTRY EXAMPLE:
<basicRegistry>
<user name="bob" password="bobpassword"/>
<user name="joe" password="joepassword"/>
<group name="group1" ...>
</group>
</basicRegistry>

<administrator-role>
<user>bob</user>
<group>group1</group>
</administrator-role>

QUICKSTARTSECURITY EXAMPLE:
<featureManager>
<feature>restConnector-2.0</feature>
</featureManager>
<quickStartSecurity userName="bob" userPassword="bobpassword" />
<keyStore id="defaultKeyStore" password="keystorePassword"/>

Check Content Reference

M

Target Key

5424