SharePoint must implement security functions as largely independent modules to avoid unnecessary interactions between modules.

From MS SharePoint 2010 Security Technical Implementation Guide

Part of SRG-APP-000237-COL-000159

Associated with: CCI-002383

SV-37789r2_rule SharePoint must implement security functions as largely independent modules to avoid unnecessary interactions between modules.

Vulnerability discussion

Microsoft recommends separate Application Pools (and security accounts) for site collections with authenticated and anonymous content; to isolate applications storing security or management information; or where users have great liberty to create and administer sites and to collaborate on content. With this configuration, if an attacker gains control of one Application Pool, they do not gain universal access to all data hosted in the SharePoint farm. Configuring separate Application Pools with the appropriate security based on access and content allows for content isolation and load balancing, limiting access to specific servers. Organizations can use custom HTTP modules for specific zones to create unique sign-on rules based on these groups of users.

Check content

1. Use the IIS Manager to navigate to the SharePoint Applications Pools and Sites list. 2. Verify the following for SharePoint applications: - Applications are not assigned to the Default Application Pool. - Central Administration is not assigned to an Application Pool with applications that have non-privileged user access. - Internet and Extranet sites are assigned to different Application Pools. Verify the Central Administration Application is in a separate Application Pool. 1. Open IIS Manager. 2. Click Application Pools. 3. Identify the SharePoint Central Administration application. 4. If SharePoint Central Administration is not the only application in the pool, this is a finding.

Fix text

Consult the IIS STIG for further guidance. Either remove applications from the application pool or create a separate application pool for the SharePoint Central Administration site.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer