Disabling sending form templates with the email forms must be configured.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-17667	DTOO168	SV-53366r1_rule	ECSC-1	Medium

Description
InfoPath allows users to attach form templates when sending email forms. If users are able to open form templates included with email forms, rather than using a cached version that is previously published, an attacker could send a malicious form template with the email form in an attempt to gain access to sensitive information. Note: The form template is only opened directly if the form opens with a restricted security level. Otherwise, the attachment is actually a link to the published location.

Description

InfoPath allows users to attach form templates when sending email forms. If users are able to open form templates included with email forms, rather than using a cached version that is previously published, an attacker could send a malicious form template with the email form in an attempt to gain access to sensitive information. Note: The form template is only opened directly if the form opens with a restricted security level. Otherwise, the attachment is actually a link to the published location.

STIG	Date
Microsoft InfoPath 2013 STIG	2015-06-18

Details

Check Text ( C-47623r1_chk )
The policy value for User Configuration -> Administrative Templates -> Microsoft InfoPath 2013 -> InfoPath e-mail forms "Disable sending form template with e-mail forms" must be set to "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\15.0\InfoPath\deployment Criteria: If the value MailXSNwithXML is REG_DWORD = 0, this is not a finding.

Check Text ( C-47623r1_chk )

The policy value for User Configuration -> Administrative Templates -> Microsoft InfoPath 2013 -> InfoPath e-mail forms "Disable sending form template with e-mail forms" must be set to "Enabled".

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\15.0\InfoPath\deployment

Criteria: If the value MailXSNwithXML is REG_DWORD = 0, this is not a finding.

Fix Text (F-46292r1_fix)
Set the policy value for User Configuration -> Administrative Templates -> Microsoft InfoPath 2013 -> InfoPath e-mail forms "Disable sending form template with e-mail forms" to "Enabled".