.NET default proxy settings must be reviewed and approved.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-225234 | APPNET0066 | SV-225234r961863_rule | CCI-000366 | low |
| Description | ||||
| The .Net framework can be configured to utilize a different proxy or altogether bypass the default proxy settings in the client's browser. This may lead to the framework using a proxy that is not approved for use. If the proxy is malicious, this could lead to a loss of application integrity and confidentiality. | ||||
| STIG | Date | |||
| Microsoft DotNet Framework 4.0 Security Technical Implementation Guide | 2025-05-16 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · 2 · disa_xccdf · related
Details
Check Text (C-225234r961863_chk)
Open Windows explorer and search for all "*.exe.config" and "machine.config" files.
Search each file for the "defaultProxy" element.
<defaultProxy
enabled="true|false"
useDefaultCredentials="true|false"
<bypasslist> … </bypasslist>
<proxy> … </proxy>
<module> … </module>
/>
If the "defaultProxy" setting "enabled=false" or if the "bypasslist", "module", or "proxy" child elements have configuration entries and there are no documented approvals from the IAO, this is a finding.
If the "defaultProxy" element is empty or if "useSystemDefault =True” then the framework is using default browser settings, this is not a finding.
Fix Text (F-26921r468018_fix)
Open Windows explorer and search for all "*.exe.config" and "machine.config" files.
Search each file for the "defaultProxy" element.
Clear the values contained in the "defaultProxy" element, and the "bypasslist", "module", and "proxy" child elements.
The IAO must provide documented approvals of any non-default proxy servers.