| V-13698 | High | The IISADMPWD directory must be removed from the Web server. | The IISADMPWD directory is included by default with IIS. It allows users to reset Windows passwords. The use of userid and passwords is a far less secure solution for controlling user access to... |
| V-13621 | High | All web server documentation, sample code, example applications, and tutorials must be removed from a production web server. | Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server. A production web server may only contain components that are operationally... |
| V-13701 | High | The command shell options must be disabled. | The command shell can be used to call arbitrary commands at the web server from within an HTML page. |
| V-6537 | High | Anonymous access accounts must be restricted. | Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect... |
| V-2247 | High | Non-administrators must not be allowed access to the directory tree, the shell, or other operating system functions and utilities. | As a rule, accounts on a web server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the web server.... |
| V-2246 | High | The web server must use a vendor-supported version of the web server software. | The web server Software, IIS 6, is no longer supported by Microsoft for security updates and is not evaluated or updated for vulnerabilities, leaving it open to potential attack. Organizations... |
| V-13591 | High | Classified web servers must be afforded physical security commensurate with the classification of its content. | When data of a classified nature is migrated to a web server, fundamental principles applicable to the safeguarding of classified material must be followed. A classified web server needs to be... |
| V-6754 | Medium | The IIS Internet Printing Protocol must be disabled. | The use of Internet Printing Protocol (IPP) on an IIS web server allows client’s access to shared printers. This privileged access could allow remote code execution by increasing the web servers... |
| V-2234 | Medium | Public web server resources must not be shared with private assets. | It is important to segregate public web server resources from private resources located behind the DoD DMZ in order to protect private assets. When folders, drives or other resources are directly... |
| V-2235 | Medium | The service account ID used to run the web service must have its password changed at least annually. | Normally, a service account is established for the web service to run under rather than permitting it to run as system or root. The password on such accounts must be changed at least annually. It... |
| V-2236 | Medium | A compiler must not be installed on a production web server. | The presence of a compiler on a production server facilitates the malicious user’s task of creating custom versions of programs and installing Trojan Horses or viruses. |
| V-2232 | Medium | The web server service password(s) must be entrusted to the SA or Web Manager. | Normally, a service account is established for the web server. This is because a privileged account is not desirable and the server is designed to run for long uninterrupted periods of time. The... |
| V-13700 | Medium | The File System Object component, if not required, must be disabled. | Some COM components are not required for most applications and should be removed if possible. Most notably, consider disabling the File System Object component; however, this will also remove the... |
| V-2259 | Medium | Web server system files must conform to minimum file permission requirements. | This check verifies the key web server system configuration files are owned by the SA or Web Manager controlled account. These same files which control the configuration of the web server, and... |
| V-6577 | Medium | A web server must not be co-hosted with other services | A detailed web server installation and configuration plan should be followed to provide standardization during the installation process. The installation and configuration plan should not support... |
| V-13722 | Medium | The UrlSegmentMaxCount registry entry must be set properly. | Http.sys is the kernel mode driver that handles HTTP requests. There are several registry keys associated with http.sys. The UrlSegmentMaxCount value determines the maximum number of URL path... |
| V-13721 | Medium | The UriMaxUriBytes registry entry must be set properly. | Http.sys is the kernel mode driver that handles HTTP requests. There are several registry keys associated with http.sys. The UriMaxUriBytes key is used to set size limits on what is cached in... |
| V-13720 | Medium | The PercentUAllowed registry entry must be set properly. | Http.sys is the kernel mode driver that handles HTTP requests. There are several registry keys associated with http.sys. The PercentUAllowed key allows the web server to accept Unicode character... |
| V-2271 | Medium | Monitoring software must include CGI type files or equivalent programs. | By their very nature, CGI type files permit the anonymous web user to interact with data and perhaps store data on the web server. In many cases, CGI scripts exercise system-level control over the... |
| V-2264 | Medium | Wscript.exe and Cscript.exe must not be accessible by users other than the SA and Web Manager. | Windows Scripting Host (WSH) is installed under either a Typical or Custom installation option of a Microsoft Network Server. This technology permits the execution of powerful script files from... |
| V-2261 | Medium | A public web server must limit e-mail to outbound only. | Incoming e-mails have been known to provide hackers with access to servers. Disabling the incoming mail service prevents this type of attacks. Additionally, e-mail is a specialized application... |
| V-2248 | Medium | Access to web administration tools must be restricted to the Web Manager and the Web Manager’s designees. | The key web service administrative and configuration tools must only be accessible by the web server staff. All users granted this authority will be documented and approved by the ISSO. Access to... |
| V-13716 | Medium | The FavorUTF8 registry key must be set properly. | Http.sys is the kernel mode driver that handles HTTP requests. There are several registry keys associated with http.sys. The FavorUTF8 registry key allows URLs to be decoded as UTF-8 before any... |
| V-13717 | Medium | The MaxFieldLength registry entry must be set properly. | By default, the MaxFieldLength registry entry is not present. This registry entry specifies the maximum size of any individual HTTP client request. Typically, this registry entry is configured... |
| V-13714 | Medium | The AllowRestrictedChars registry key must be disabled. | IIS6 Http.sys is the kernel mode driver that handles HTTP requests. There are several registry keys associated with http.sys. If the AllowRestrictedChars key is set to a nonzero value, Http.sys... |
| V-13715 | Medium | The EnableNonUTF8 registry key must be disabled. | Http.sys is the kernel mode driver that handles HTTP requests. There are several registry keys associated with http.sys. The EnableNonUTF8 registry key expands the amount of character types the... |
| V-13718 | Medium | The MaxRequestBytes registry entry must be set properly. | Http.sys is the kernel mode driver that handles HTTP requests. There are several registry keys associated with http.sys. The MaxRequestBytes registry key determines the upper limit for the total... |
| V-13719 | Medium | The UrlSegmentMaxLength registry entry must be set properly. | Http.sys is the kernel mode driver that handles HTTP requests. There are several registry keys associated with http.sys. The UrlSegmentMaxLength key sets the maximum number of characters in a... |
| V-13613 | Medium | The site software used with the web server must have all applicable security patches applied and documented. | The IAVM process does not address all patches that have been identified for the host operating system or, in this case, the web server software environment. Many vendors have subscription services... |
| V-2243 | Medium | A private web server must be located on a separate controlled access subnet. | Private web servers, which host sites serving controlled access data, must be protected from outside threats in addition to insider threats. Insider threat may be accidental or intentional but, in... |
| V-2242 | Medium | A public web server, if hosted on the NIPRNet, must be isolated in an accredited DoD DMZ Extension. | To minimize exposure of private assets to unnecessary risk by attackers, public web servers must be isolated from internal systems. Public web servers are by nature more vulnerable to attack from... |
| V-6485 | Low | Web server content and configuration files must be part of a routine backup program. | Backing up web server data and web server application software after upgrades or maintenance ensures that recovery can be accomplished up to the current version. It also provides a means to... |
| V-2257 | Low | Administrative users and groups with access privilege to the web server must be documented. | There are typically several individuals and groups involved in running a production web site. In most cases, several types of users on a web server can be identified such as SA's, Web Managers,... |
| V-2251 | Low | Programs and features not necessary for operations must be removed. | Just as running unneeded services and protocols increase the attack surface of the web server, running unneeded utilities and programs is also an added risk to the web server. |
| V-6724 | Low | Web server and/or operating system information must be protected. | The web server response header of an HTTP response can contain several fields of information including the requested HTML page. The information included in this response can be web server type and... |
