UCF STIG Viewer Logo

The production web-site must filter unlisted file extensions in URL requests.


Overview

Finding ID Version Rule ID IA Controls Severity
V-26046 WA000-WI6260 SV-32697r2_rule Medium
Description
Request filtering enables administrators to create a more granular rule set to allow or reject inbound web content. By setting limits on web requests it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The allow unlisted property of the File Extensions Request Filter enables rejection of requests containing specific file extensions not defined in the File Extensions filter. Tripping this filter will cause IIS to generate a Status Code 404.7.
STIG Date
IIS 7.0 WEB SITE STIG 2017-12-21

Details

Check Text ( C-32894r1_chk )
For each site reviewed:
1. Open the IIS Manager.
2. Click on the site name.
3. Double-click the Request Filtering icon.
4. Click Edit Feature Settings in the Actions Pane.

If allow unlisted file extensions checkbox is checked, this is a finding.
Fix Text (F-29040r1_fix)
1. Open the IIS Manager.
2. Click the site name under review.
3. Double-click the Request Filtering icon.
4. Click Edit Feature Settings in the Actions Pane.
5. Uncheck the allow unlisted file extensions checkbox.