Microsoft IIS 8.5 Site Security Technical Implementation Guide

The Microsoft IIS 8.5 Site Security Technical Implementation Guide (V2 R9) has 49 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

49STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R9

CurrentPublished Wed Oct 25 2023

Non-ASCII characters in URLs must be prohibited by any IIS 8.5 website.

Microsoft IIS 8.5 Site Security Technical Implementation Guide

Assessment Title

Rule Text

Non-ASCII characters in URLs must be prohibited by any IIS 8.5 website.

Description

Discussion Text

By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The allow high-bit characters Request Filter enables rejection of requests containing non-ASCII characters.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-214467

Rule

SV-214467r879650_rule

Severity

medium

Rule Version

IISW-SI-000228

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Follow the procedures below for each site hosted on the IIS 8.5 web server:

Open the IIS 8.5 Manager.

Click on the site name.

Double-click the "Request Filtering" icon.

Click "Edit Feature Settings" in the "Actions" pane.

If the "Allow high-bit characters" check box is checked, this is a finding.

Implementation Procedure

Fix Text

Follow the procedures below for each site hosted on the IIS 8.5 web server:

Open the IIS 8.5 Manager.

Click the site name under review.

Double-click the "Request Filtering" icon.

Click "Edit Feature Settings" in the "Actions" pane.

Uncheck the "Allow high-bit characters" check box.

STIG check 22 of 49 in the Microsoft IIS 8.5 Site STIG checklist

← Previous · V-214466The IIS 8.5 websites Maximum Query String limit must be configured.Next · V-214468 →Double encoded URL requests must be prohibited by any IIS 8.5 website.