UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The IIS 8.5 website must prevent a web content directory from being displayed.


Overview

Finding ID Version Rule ID IA Controls Severity
V-76831 IISW-SI-000232 SV-91527r1_rule Medium
Description
The goal is to control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Also, enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server’s directory structure by locating directories with default pages. This practice helps ensure the anonymous web user will not obtain directory browsing information or an error message revealing the server type and version.
STIG Date
IIS 8.5 Site Security Technical Implementation Guide 2018-04-06

Details

Check Text ( C-76487r1_chk )
Note: This requirement is only for each site's root directory.

Follow the procedures below for each site hosted on the IIS 8.5 web server:

Click the site name under review.

Double-click "Default Document".

In the "Actions" pane, verify the "Default Document" feature is enabled.

If an "Enable" option is listed under the "Actions" pane, the "Default Document" feature is not enabled and this is a finding.

If "Default Document" is "Enabled, review the document types.

Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Verify there is a document of that type in the directory.

If "Default Document" is "Enabled" but no listed document types are present in the "Content View", this is a finding.
Fix Text (F-83527r1_fix)
Follow the procedures below for each site hosted on the IIS 8.5 web server:

Open the IIS 8.5 Manager.

Click the site name under review.

Double-click "Default Document".

In the “Actions” pane select "Enable".

Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Create a valid document for the listed "Default Document".