Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The IIS 8.5 websites Maximum Query String limit must be configured.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-76821 | IISW-SI-000227 | SV-91517r1_rule | Medium |
| Description |
|---|
| By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The Maximum Query String Request Filter describes the upper limit on allowable query string lengths. Upon exceeding the configured value, IIS will generate a Status Code 404.15. |
| STIG | Date |
|---|---|
| IIS 8.5 Site Security Technical Implementation Guide | 2018-04-06 |
Details
| Check Text ( C-76477r1_chk ) |
|---|
| Follow the procedures below for each site hosted on the IIS 8.5 web server: Open the IIS 8.5 Manager. Click on the site name. Double-click the "Request Filtering" icon. Click “Edit Feature Settings” in the "Actions" pane. If the "Maximum Query String" value is not set to "2048" or less, this is a finding. |
| Fix Text (F-83517r1_fix) |
|---|
| Follow the procedures below for each site hosted on the IIS 8.5 web server: Open the IIS 8.5 Manager. Click the site name under review. Double-click the "Request Filtering" icon. Click “Edit Feature Settings” in the "Actions" pane. Set the "Maximum Query String" value to "2048" or less. |