Details

The indexing service can be used to facilitate a search function for websites. Enabling indexing may facilitate a directory traversal exploit and reveal unwanted information to a malicious user. Indexing must be limited to web document directories only.

Solution

Run MMC.

Add the Indexing Service snap-in.

Edit the indexed directories to only include web document directories.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_IIS_10-0_Y20M10_STIG.ziphttps://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_IIS_10-0_Y20M10_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: System and Information Integrity.This control applies to the following type of system Windows.

References

• 800-53|SI-11a.
• CAT|II
• CCI|CCI-001312
• Rule-ID|SV-218809r561041_rule
• STIG-ID|IIST-SV-000139
• STIG-Legacy|SV-109257
• STIG-Legacy|V-100153
• Vuln-ID|V-218809

Source

• Tenable.com/audits