Each readable web document directory must contain a default, home, index, or equivalent document.

Part of WG170

SV-32324r2_rule Each readable web document directory must contain a default, home, index, or equivalent document.

Vulnerability discussion

The goal is to control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Also, enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server’s directory structure by locating directories with default pages. This practice helps ensure the anonymous web user will not obtain directory browsing information or an error message revealing the server type and version.

Check content

1. Open the IIS Manager. 2. Click the site name under review. 3. Double-click Default Document. 4. In the Actions Pane, verify the Default Document feature is enabled. If not, this is a finding. 5. Review the document types. 6. Click the Content View tab and ensure there is a document of that type in the directory. If not, this is a finding.

Fix text

1. Open the IIS Manager. 2. Click the site name under review. 3. Double-click Default Document. 4. In the Action pane select Enable. 5. Click the Content View tab and ensure there is a document of that type in the directory.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.