Details
The FileExtensions Request Filter allows administrators to define specific extensions their web server(s) will allow and disallow. The property allowUnlisted will cover all other file extensions not explicitly allowed or denied. Often times, extensions such as .config, .bat, .exe, to name a few, should never be served. The AllowExtensions and DenyExtensions options are the UrlScan equivalents. It is recommended that all extensions be unallowed at the most global level possible, with only those necessary being allowed.
Rationale:
Disallowing all but the necessary file extensions can greatly reduce the attack surface of applications and servers.
Solution
The allowUnlisted Request Filter may be set for a server, website, or application using the IIS Manager GUI, using AppCmd.exe commands in a command-line window, and/or directly editing the configuration files. To configure at the server level using the IIS Manager GUI:
1. Open Internet Information Services (IIS) Manager
2. In the Connections pane, select the server
3. In the Home pane, double-click Request Filtering
4. Click Edit Feature Settings… in the Actions pane
5. Under the General section, uncheck Allow unlisted file name extensions
Enter the following command in AppCmd.exe to configure:
%systemroot%system32inetsrvappcmd set config /section:requestfiltering /fileExtensions.allowunlisted:false
OR
Enter the following command in PowerShell to configure:
Set-WebConfigurationProperty -pspath ‘MACHINE/WEBROOT/APPHOST’ -filter ‘system.webServer/security/requestFiltering/fileExtensions’ -name ‘allowUnlisted’ -value ‘False’
Default Value:
The default Request Filtering configuration allows all unlisted file extensions to be requested.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.