All web server documentation, sample code, example applications, and tutorials must be removed from a production web server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-13621	WG385 IIS7	SV-32478r1_rule	ECSC-1	High

Description
Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server. A production web server may only contain components that are operationally necessary (i.e., compiled code, scripts, web content, etc.). Delete all directories containing samples and any scripts used to execute the samples.

STIG	Date
IIS 7.0 WEB SERVER STIG	2014-12-10

Details

Check Text ( C-32792r1_chk )
1. Navigate to the following folders: inetpub\AdminScripts inetpub\scripts\IISSamples Program Files\Common Files\System\msadc 2. If the folders contain sample code and documentation, this is a finding. NOTE: Any non-executable web server documentation or sample file found on the production web server and accessible to web users or non-administrators will be a CAT III finding. Any non-executable web server documentation or sample file found on the production web server and accessible only to SAs or to web administrators is permissible and is not a finding.

Check Text ( C-32792r1_chk )

1. Navigate to the following folders:
inetpub\AdminScripts
inetpub\scripts\IISSamples
Program Files\Common Files\System\msadc
2. If the folders contain sample code and documentation, this is a finding.

NOTE: Any non-executable web server documentation or sample file found on the production web server and accessible to web users or non-administrators will be a CAT III finding.
Any non-executable web server documentation or sample file found on the production web server and accessible only to SAs or to web administrators is permissible and is not a finding.

Fix Text (F-29072r1_fix)
Remove sample code and documentation from the web server.