UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

Non-ASCII characters in URLs must be prohibited by any IIS 8.5 website.


Overview

Finding ID Version Rule ID IA Controls Severity
V-214467 IISW-SI-000228 SV-214467r879650_rule Medium
Description
By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The allow high-bit characters Request Filter enables rejection of requests containing non-ASCII characters.
STIG Date
Microsoft IIS 8.5 Site Security Technical Implementation Guide 2022-12-09

Details

Check Text ( C-15676r310605_chk )
Follow the procedures below for each site hosted on the IIS 8.5 web server:

Open the IIS 8.5 Manager.

Click on the site name.

Double-click the "Request Filtering" icon.

Click “Edit Feature Settings” in the "Actions" pane.

If the "Allow high-bit characters" check box is checked, this is a finding.
Fix Text (F-15674r310606_fix)
Follow the procedures below for each site hosted on the IIS 8.5 web server:

Open the IIS 8.5 Manager.

Click the site name under review.

Double-click the "Request Filtering" icon.

Click “Edit Feature Settings” in the "Actions" pane.

Uncheck the "Allow high-bit characters" check box.