STIGQter: STIG Summary: Microsoft IIS 8.5 Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The IIS 8.5 web server must use cookies to track session state.

DISA Rule

SV-214419r508658_rule

Vulnerability Number

V-214419

Group Title

SRG-APP-000223-WSR-000011

Rule Version

IISW-SV-000134

Severity

CAT II

CCI(s)

• CCI-001185 - The information system invalidates session identifiers upon user logout or other session termination.
• CCI-001664 - The information system recognizes only session identifiers that are system-generated.

Weight

10

Fix Recommendation

Open the IIS 8.5 Manager.

Click the IIS 8.5 web server name.

Under "ASP.Net", double-click on the "Session State" icon.

Under "Cookie Settings", select "Use Cookies” from the "Mode" drop-down list.

Click "Apply" in the "Actions" pane.

Check Contents

Note: If IIS 8.5 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.

Open the IIS 8.5 Manager.
Click the IIS 8.5 web server name.
Under "ASP.Net", double-click on the "Session State" icon.
Under "Cookie Settings", verify the "Mode" has "Use Cookies" selected from the drop-down list.

If the "Cookie Settings" "Mode" is not set to "Use Cookies", this is a finding.

Alternative method:
Click the site name.
Select "Configuration Editor" under the "Management" section.
From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
Verify the "cookieless" is set to "UseCookies".

If the "cookieless" is not set to "UseCookies", this is a finding.

Vulnerability Number

V-214419

Documentable

False

Rule Version

IISW-SV-000134

Severity Override Guidance

Note: If IIS 8.5 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.

Open the IIS 8.5 Manager.
Click the IIS 8.5 web server name.
Under "ASP.Net", double-click on the "Session State" icon.
Under "Cookie Settings", verify the "Mode" has "Use Cookies" selected from the drop-down list.

If the "Cookie Settings" "Mode" is not set to "Use Cookies", this is a finding.

Alternative method:
Click the site name.
Select "Configuration Editor" under the "Management" section.
From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
Verify the "cookieless" is set to "UseCookies".

If the "cookieless" is not set to "UseCookies", this is a finding.

Check Content Reference

M

Target Key

4000

Comments