STIGQter STIGQter: STIG Summary: IIS 8.5 Site Security Technical Implementation Guide Version: 1 Release: 9 Benchmark Date: 25 Oct 2019: Mappings to unused and vulnerable scripts on the IIS 8.5 website must be removed.

DISA Rule

SV-91495r2_rule

Vulnerability Number

V-76799

Group Title

SRG-APP-000141-WSR-000082

Rule Version

IISW-SI-000215

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Open the IIS 8.5 Manager.

Click the site name under review.

Double-click Request Filtering->File Name Extensions Tab->Deny File Name Extension.

Add any script file extensions listed on the black list that are not listed.

Select "Apply" from the "Actions" pane.

Check Contents

For "Request Filtering", the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Request Filtering" in IIS 8.5. "Request Filtering" at the site level take precedence over "Request Filtering" at the server level.

Open the IIS 8.5 Manager.

Click the site name under review.

Double-click Request Filtering->File Name Extensions Tab.

If any script file extensions from the black list are not denied, this is a finding.

Vulnerability Number

V-76799

Documentable

False

Rule Version

IISW-SI-000215

Severity Override Guidance

For "Request Filtering", the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Request Filtering" in IIS 8.5. "Request Filtering" at the site level take precedence over "Request Filtering" at the server level.

Open the IIS 8.5 Manager.

Click the site name under review.

Double-click Request Filtering->File Name Extensions Tab.

If any script file extensions from the black list are not denied, this is a finding.

Check Content Reference

M

Target Key

2791

Comments