The access control files are owned by a privileged web server account.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2256	WG280	SV-2256r1_rule		Medium

Description
This check verifies that the key web server system configuration files are owned by the SA or by the web administrator controlled account. These same files which control the configuration of the web server and, thus, its behavior must also be accessible by the account that runs the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.

Description

This check verifies that the key web server system configuration files are owned by the SA or by the web administrator controlled account. These same files which control the configuration of the web server and, thus, its behavior must also be accessible by the account that runs the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.

STIG	Date
IIS 7.0 Server STIG	2019-03-22

Details

Check Text ( C-29943r2_chk )
Query the SA or the web administrator to determine if an access control file is used by the web server and to obtain the name and location of those files. Verify the permissions on these files. If .htaccess or the .htaccess.html files are in use, the SA or the web administrator account may have Full Control and the non-privileged web server account running the web service should have read and execute permissions. If entries other than administrators, the web administrator accounts, or the system for any degree of access are present, this is a finding.

Check Text ( C-29943r2_chk )

Query the SA or the web administrator to determine if an access control file is used by the web server and to obtain the name and location of those files. Verify the permissions on these files.

If .htaccess or the .htaccess.html files are in use, the SA or the web administrator account may have Full Control and the non-privileged web server account running the web service should have read and execute permissions.

If entries other than administrators, the web administrator accounts, or the system for any degree of access are present, this is a finding.

Fix Text (F-26814r1_fix)
Ensure that the owner is a privileged account and not the web server account or equivalent which runs the web service.