Include local directory path when uploading files to a server is properly set (Restricted Sites Zone).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22158	DTBI860	SV-44645r1_rule	ECSC-1	Medium

Description
This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent.

Description

This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent.

STIG	Date
Microsoft IE Version 7	2012-11-29

Details

Check Text ( C-42149r3_chk )
The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> “Include local directory path when uploading files to a server” will be set to “Enabled” and “Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 160A is REG_DWORD = 3, this is not a finding.

Check Text ( C-42149r3_chk )

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> “Include local directory path when uploading files to a server” will be set to “Enabled” and “Disable” selected from the drop-down box.

Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4

Criteria: If the value 160A is REG_DWORD = 3, this is not a finding.

Fix Text (F-38101r2_fix)
The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> “Include local directory path when uploading files to a server” will be set to “Enabled” and “Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 160A to REG_DWORD = 3, this is not a finding.

Fix Text (F-38101r2_fix)

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> “Include local directory path when uploading files to a server” will be set to “Enabled” and “Disable” selected from the drop-down box.

Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4

Criteria: Set the value 160A to REG_DWORD = 3, this is not a finding.