WEBSERVICE functions must be disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-41344	DTOO418	SV-53841r1_rule		Medium

Description
The WEBSERVICE function option, when used in an Excel spreadsheet, returns data from a web service on the Internet or Intranet. If allowed to be used, security is significantly reduced by allowing information disclosure to third party web services and could potentially introduce malicious content to the local network. The WEBSERVICE function must be disabled in Excel and configured to notify user if a WEBSERVICE function is present in an Excel spreadsheet.

Description

The WEBSERVICE function option, when used in an Excel spreadsheet, returns data from a web service on the Internet or Intranet. If allowed to be used, security is significantly reduced by allowing information disclosure to third party web services and could potentially introduce malicious content to the local network. The WEBSERVICE function must be disabled in Excel and configured to notify user if a WEBSERVICE function is present in an Excel spreadsheet.

STIG	Date
Microsoft Excel 2013 STIG	2018-04-03

Details

Check Text ( C-47896r1_chk )
Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2013 -> Excel Options -> Security -> " WEBSERVICE Function Notification Settings" is set to "Enabled: Disable all with notifications". Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\software\policies\Microsoft\office\15.0\excel\security Criteria: If the value webservicefunctionwarnings is REG_DWORD = 1, this is not a finding.

Check Text ( C-47896r1_chk )

Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2013 -> Excel Options -> Security -> " WEBSERVICE Function Notification Settings" is set to "Enabled: Disable all with notifications".

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\software\policies\Microsoft\office\15.0\excel\security

Criteria: If the value webservicefunctionwarnings is REG_DWORD = 1, this is not a finding.

Fix Text (F-46744r1_fix)
Set policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2013 -> Excel Options -> Security -> " WEBSERVICE Function Notification Settings" is set to "Enabled: Disable all with notifications".