Directory Browsing on the IIS 8.5 web server must be disabled.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-76733 | IISW-SV-000138 | SV-91429r2_rule | Medium |
| Description |
|---|
| Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled the risk of inadvertently disclosing sensitive content is increased. |
| STIG | Date |
|---|---|
| IIS 8.5 Server Security Technical Implementation Guide | 2020-06-05 |
Details
| Check Text ( C-76389r2_chk ) |
|---|
| If the Directory Browsing IIS Feature is disabled, this is Not Applicable. Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the "Directory Browsing" icon. Under the “Actions” pane verify "Directory Browsing" is disabled. If “Directory Browsing” is not disabled, this is a finding. |
| Fix Text (F-83429r2_fix) |
|---|
| If the Directory Browsing IIS Feature is disabled, this is Not Applicable. Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the "Directory Browsing" icon. Under the "Actions" pane click "Disabled". Under the "Actions" pane, click "Apply". |