Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
Unspecified file extensions must not be allowed to execute on the production web server.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-25999 | WA000-WI6100 | SV-32650r2_rule | Medium |
| Description |
|---|
| By allowing unspecified file extensions to execute, the web servers attack surface is significantly increased. This increased risk can be reduced by only allowing specific ISAPI extensions or CGI extensions to run on the web server. |
| STIG | Date |
|---|---|
| IIS 7.0 WEB SERVER STIG | 2017-06-28 |
Details
| Check Text ( C-32871r1_chk ) |
|---|
| 1. Open the IIS Manager. 2. Click the Server. 3. Double-click the ISAPI and CGI restrictions icon. 4. Click Edit Feature Settings and verify the CGI and ISAPI Modules are NOT checked. If they are checked, this is a finding. |
| Fix Text (F-29023r1_fix) |
|---|
| 1. Open the IIS Manager. 2. Click the Server. 3. Double-click the ISAPI and CGI restrictions icon. 4. Click Edit Feature Settings and uncheck the CGI and ISAPI Modules check boxes. |