The IIS 8.5 website must prevent a web content directory from being displayed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-76831	IISW-SI-000232	SV-91527r1_rule		Medium

Description
The goal is to control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Also, enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server’s directory structure by locating directories with default pages. This practice helps ensure the anonymous web user will not obtain directory browsing information or an error message revealing the server type and version.

Description

The goal is to control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Also, enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server’s directory structure by locating directories with default pages. This practice helps ensure the anonymous web user will not obtain directory browsing information or an error message revealing the server type and version.

STIG	Date
IIS 8.5 Site Security Technical Implementation Guide	2018-09-18

Details

Check Text ( C-76487r1_chk )
Note: This requirement is only for each site's root directory. Follow the procedures below for each site hosted on the IIS 8.5 web server: Click the site name under review. Double-click "Default Document". In the "Actions" pane, verify the "Default Document" feature is enabled. If an "Enable" option is listed under the "Actions" pane, the "Default Document" feature is not enabled and this is a finding. If "Default Document" is "Enabled, review the document types. Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Verify there is a document of that type in the directory. If "Default Document" is "Enabled" but no listed document types are present in the "Content View", this is a finding.

Check Text ( C-76487r1_chk )

Note: This requirement is only for each site's root directory.

Follow the procedures below for each site hosted on the IIS 8.5 web server:

Click the site name under review.

Double-click "Default Document".

In the "Actions" pane, verify the "Default Document" feature is enabled.

If an "Enable" option is listed under the "Actions" pane, the "Default Document" feature is not enabled and this is a finding.

If "Default Document" is "Enabled, review the document types.

Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Verify there is a document of that type in the directory.

If "Default Document" is "Enabled" but no listed document types are present in the "Content View", this is a finding.

Fix Text (F-83527r1_fix)
Follow the procedures below for each site hosted on the IIS 8.5 web server: Open the IIS 8.5 Manager. Click the site name under review. Double-click "Default Document". In the “Actions” pane select "Enable". Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Create a valid document for the listed "Default Document".