STIGQter: STIG Summary: Microsoft IIS 8.5 Site Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

Non-ASCII characters in URLs must be prohibited by any IIS 8.5 website.

DISA Rule

SV-214467r508659_rule

Vulnerability Number

V-214467

Group Title

SRG-APP-000246-WSR-000149

Rule Version

IISW-SI-000228

Severity

CAT II

CCI(s)

• CCI-001094 - The information system restricts the ability of individuals to launch organization-defined denial of service attacks against other information systems.

Weight

10

Fix Recommendation

Follow the procedures below for each site hosted on the IIS 8.5 web server:

Open the IIS 8.5 Manager.

Click the site name under review.

Double-click the "Request Filtering" icon.

Click “Edit Feature Settings” in the "Actions" pane.

Uncheck the "Allow high-bit characters" check box.

Check Contents

Follow the procedures below for each site hosted on the IIS 8.5 web server:

Open the IIS 8.5 Manager.

Click on the site name.

Double-click the "Request Filtering" icon.

Click “Edit Feature Settings” in the "Actions" pane.

If the "Allow high-bit characters" check box is checked, this is a finding.

Vulnerability Number

V-214467

Documentable

False

Rule Version

IISW-SI-000228

Severity Override Guidance

Follow the procedures below for each site hosted on the IIS 8.5 web server:

Open the IIS 8.5 Manager.

Click on the site name.

Double-click the "Request Filtering" icon.

Click “Edit Feature Settings” in the "Actions" pane.

If the "Allow high-bit characters" check box is checked, this is a finding.

Check Content Reference

M

Target Key

4001

Comments