Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-2245 | WG170 | SV-2245r1_rule | Low |
Description |
---|
The goal is to completely control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Also, enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server’s directory structure by locating directories with default pages. This practice helps ensure that the anonymous web user will not obtain directory browsing information or an error message that reveals the server type and version. |
STIG | Date |
---|---|
IIS 7.0 Server STIG | 2019-03-22 |
Check Text ( C-29333r1_chk ) |
---|
To view the DocumentRoot value enter the following command: grep "DocumentRoot" /usr/local/apache2/conf/httpd.conf Note the location following the DocumentRoot string, this is the path to the document root directory. Browse to the document root directory and any sub directories. If a directory does not contain a default document, then this is a finding. |
Fix Text (F-26805r1_fix) |
---|
Add an default document to the applicable directories. |