The IIS 8.5 website must prevent a web content directory from being displayed.

From IIS 8.5 Site Security Technical Implementation Guide

Part of SRG-APP-000266-WSR-000142

Associated with: CCI-001312

SV-91527r1_rule The IIS 8.5 website must prevent a web content directory from being displayed.

Vulnerability discussion

The goal is to control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Also, enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server’s directory structure by locating directories with default pages. This practice helps ensure the anonymous web user will not obtain directory browsing information or an error message revealing the server type and version.

Check content

Note: This requirement is only for each site's root directory. Follow the procedures below for each site hosted on the IIS 8.5 web server: Click the site name under review. Double-click "Default Document". In the "Actions" pane, verify the "Default Document" feature is enabled. If an "Enable" option is listed under the "Actions" pane, the "Default Document" feature is not enabled and this is a finding. If "Default Document" is "Enabled, review the document types. Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Verify there is a document of that type in the directory. If "Default Document" is "Enabled" but no listed document types are present in the "Content View", this is a finding.

Fix text

Follow the procedures below for each site hosted on the IIS 8.5 web server: Open the IIS 8.5 Manager. Click the site name under review. Double-click "Default Document". In the “Actions” pane select "Enable". Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Create a valid document for the listed "Default Document".

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer