Content Index Service indexes directories, other than web document directories.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3963	WA000-WI070	SV-3963r1_rule		Low

Description
Enabling indexing also facilitates directory traversal exploits. To reveal such information to a malicious user is potentially harmful. Such information and the contents of files listed are normally readable by the anonymous Web user, yet are not intended to be viewed as they often contain information relevant to the configuration and security of the Web service. The indexing service can be used to facilitate a search function for large Web sites.

Description

Enabling indexing also facilitates directory traversal exploits. To reveal such information to a malicious user is potentially harmful. Such information and the contents of files listed are normally readable by the anonymous Web user, yet are not intended to be viewed as they often contain information relevant to the configuration and security of the Web service. The indexing service can be used to facilitate a search function for large Web sites.

STIG	Date
IIS 7.0 Server STIG	2019-03-22

Details

Check Text ( C-2863r1_chk )
From Internet Services Manager: >> Select web site to be examined. Select Properties option by right clicking. Select Home Directory tab. In the dialog menus that appear, if the Indexing checkbox is selected, go to the Services from Administrative Tools in Control panel and check to see if the Indexing Service is installed. If it is, determine if the start mode is either “Automatic” or “Manual“. If the Indexing checkbox is not checked or the indexing service is not installed or disabled, this is not a finding. If the Indexing checkbox is checked and the service is either Manual or Automatic, use the following procedure to examine the directories to be indexed. With the assistance of the web administrator and or SA use the Microsoft Management Console (MMC) to evaluate this catalog. Start >> Run >>mmc >> console >> add remove snap-in >> indexing service (add). Review the directories being indexed. If this service is in use only the web content folders should be indexed. If you are not sure if it is a web content folder, examine the Home Directory tab within the properties of the web site. This will indicate the path of the content for this web site. If the Index Service is running and directories other than web content directories are being indexed, this is a finding. --------------------

Check Text ( C-2863r1_chk )

From Internet Services Manager:

>> Select web site to be examined. Select Properties option by right clicking. Select Home Directory tab.

In the dialog menus that appear, if the Indexing checkbox is selected, go to the Services from Administrative Tools in Control panel and check to see if the Indexing Service is installed. If it is, determine if the start mode is either “Automatic” or “Manual“.

If the Indexing checkbox is not checked or the indexing service is not installed or disabled, this is not a finding.

If the Indexing checkbox is checked and the service is either Manual or Automatic, use the following procedure to examine the directories to be indexed.

With the assistance of the web administrator and or SA use the Microsoft Management Console (MMC) to evaluate this catalog. Start >> Run >>mmc >> console >> add remove snap-in >> indexing service (add). Review the directories being indexed.

If this service is in use only the web content folders should be indexed. If you are not sure if it is a web content folder, examine the Home Directory tab within the properties of the web site. This will indicate the path of the content for this web site.

If the Index Service is running and directories other than web content directories are being indexed, this is a finding.

--------------------

Fix Text (F-3896r1_fix)
Assure that only the web document directories are indexed.