Details

Disable unexposed Host Guest File System Server feature.

*Rationale*

Certain automated operations such as automated tools upgrades use a component into the

hypervisor called Host Guest File System (HGFS) and an attacker could potentially use this

to transfer files inside the guest OS.

Solution

To implement the recommended configuration state, run the following PowerCLI
command-# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name ‘isolation.tools.hgfsServerSet.disable’ -value
$true

Impact-Setting isolation.tools.hgfsServerSet.disable to true disables registration of the guest’s
HGFS server with the host. APIs that use HGFS to transfer files to and from the guest
operating system, such as some VIX commands or the VMware Tools auto-upgrade utility,
will not function.

Default Value-The prescribed state is not the default state.

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/902

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system VMware.

References

• 800-53|CM-7

Source

• Tenable.com/audits