Web content directories anonymously shared via a network share.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2226	WG210	SV-2226r1_rule		Medium

Description
Such sharing is a security risk when a web server is involved. Users accessing the share anonymously could experience privileged access to the content of such directories. Network sharable directories expose those directories and their contents to unnecessary access. Any unnecessary exposure increases the risk that someone could exploit that access and either compromises the web content or cause web server performance problems. NIST Guidelines for Securing Public Web Servers (par. 8.6 pg. 75, a principle reference for this document) states “Do not mount any file shares on the internal network from the Web server or vice versa”. The presence of shares is indicative of a remote management solution or a development server. Alternatives to shares are a secure ftp products or related remote admin tools.

Description

Such sharing is a security risk when a web server is involved. Users accessing the share anonymously could experience privileged access to the content of such directories. Network sharable directories expose those directories and their contents to unnecessary access. Any unnecessary exposure increases the risk that someone could exploit that access and either compromises the web content or cause web server performance problems. NIST Guidelines for Securing Public Web Servers (par. 8.6 pg. 75, a principle reference for this document) states “Do not mount any file shares on the internal network from the Web server or vice versa”. The presence of shares is indicative of a remote management solution or a development server. Alternatives to shares are a secure ftp products or related remote admin tools.

STIG	Date
IIS 7.0 Server STIG	2019-03-22

Details

Check Text ( C-2385r1_chk )
Move to the %systemroot%\system32\inetsrv\ directory and examine the properties of this directory. Sharing should not be selected Using the Internet Information Services Console, locate the web site being reviewed. Select this web site and right click on it, then select its Properties. When the menu screens appear, select the Home Directory tab. Make a note on the checklist sheet of the path to the web site’s home directory. Administrative shares are not exempt from this requirement. Using Explorer, locate the path identified above. Right click on the directory to be examined. Select Properties; Select the “Sharing” tab. If the "Do not share this folder" is not selected, this is a finding. Navigate to the "Web Sharing" tab, select the web site you are reviewing from the pull down menu. The "Share this folder" can be selected, and will be in most cases if the web site is readable. The following entry could be present in the list: "/" If the web site is readable, the above entry will be in the list and is acceptable and should not be marked as a finding. If there are any other aliases in the list, this is a finding. Note: In the case of a storage area network or file storage network, where partitions on the storage device are dedicated to a front end /back end web services, the additional partitions will be mapped to the correct file storage network partition in the web server configuration. This can apply to both web content and web scripts. NOTE: The presence of operating system shares on the web server is not an issue as long as the shares are not part of the web content directories. The use of shares to move content from one environment to another is permitted if the following conditions are met: they are approved by the IAM/IAO, the shares are restricted to only allow administrators write access, the use of the shares does not bypass the sites approval process for posting new content to the web server, and Developers are only permitted read access to these directories.

Check Text ( C-2385r1_chk )

Move to the %systemroot%\system32\inetsrv\ directory and examine the properties of this directory. Sharing should not be selected

Using the Internet Information Services Console, locate the web site being reviewed. Select this web site and right click on it, then select its Properties. When the menu screens appear, select the Home Directory tab. Make a note on the checklist sheet of the path to the web site’s home directory. Administrative shares are not exempt from this requirement.

Using Explorer, locate the path identified above. Right click on the directory to be examined. Select Properties; Select the “Sharing” tab. If the "Do not share this folder" is not selected, this is a finding.

Navigate to the "Web Sharing" tab, select the web site you are reviewing from the pull down menu. The "Share this folder" can be selected, and will be in most cases if the web site is readable.

The following entry could be present in the list:

"/"

If the web site is readable, the above entry will be in the list and is acceptable and should not be marked as a finding.

If there are any other aliases in the list, this is a finding.

Note: In the case of a storage area network or file storage network, where partitions on the storage device are dedicated to a front end /back end web services, the additional partitions will be mapped to the correct file storage network partition in the web server configuration. This can apply to both web content and web scripts.

NOTE: The presence of operating system shares on the web server is not an issue as long as the shares are not part of the web content directories. The use of shares to move content from one environment to another is permitted if the following conditions are met: they are approved by the IAM/IAO, the shares are restricted to only allow administrators write access, the use of the shares does not bypass the sites approval process for posting new content to the web server, and Developers are only permitted read access to these directories.

Fix Text (F-2275r1_fix)
Remove the shares from the applicable directories.