All web server documentation, sample code, example applications, and tutorials must be removed from a production web server.

Part of WG385

SV-32478r3_rule All web server documentation, sample code, example applications, and tutorials must be removed from a production web server.

Vulnerability discussion

Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server. A production web server may only contain components that are operationally necessary (i.e., compiled code, scripts, web content, etc.). Delete all directories containing samples and any scripts used to execute the samples.

Check content

1. Navigate to the following folders: inetpub\AdminScripts inetpub\scripts\IISSamples Program Files\Common Files\System\msadc Program Files (x86)\Common Files\System\msadc 2. If the folders contain sample code and documentation, this is a finding. Note: Any non-executable web server documentation or sample file found on the production web server and accessible to web users or non-administrators will be a CAT III finding. Any non-executable web server documentation or sample file found on the production web server and accessible only to SAs or to web administrators is permissible and is not a finding.

Fix text

Remove sample code and documentation from the web server.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.