STIGQter: STIG Summary: Microsoft IIS 10.0 Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The IIS 10.0 web server must use cookies to track session state.

DISA Rule

SV-218804r561041_rule

Vulnerability Number

V-218804

Group Title

SRG-APP-000223-WSR-000011

Rule Version

IIST-SV-000134

Severity

CAT II

CCI(s)

• CCI-001664 - The information system recognizes only session identifiers that are system-generated.

Weight

10

Fix Recommendation

Open the IIS 10.0 Manager.

Click the IIS 10.0 web server name.

Under "ASP.Net", double-click the "Session State" icon.

Under "Cookie Settings", select "Use Cookies” from the "Mode" drop-down list.

Click "Apply" in the "Actions" pane.

Check Contents

Open the IIS 10.0 Manager.
Click the IIS 10.0 web server name.
Under "ASP.Net", double-click the "Session State" icon.
Under "Cookie Settings", verify the "Mode" has "Use Cookies" selected from the drop-down list.
If the "Cookie Settings" "Mode" is not set to "Use Cookies", this is a finding.

Alternative method:

Click the site name.
Select "Configuration Editor" under the "Management" section.
From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
Verify the "cookieless" is set to "UseCookies".
If the "cookieless" is not set to "UseCookies", this is a finding.

Note: If IIS 10.0 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.

Vulnerability Number

V-218804

Documentable

False

Rule Version

IIST-SV-000134

Severity Override Guidance

Open the IIS 10.0 Manager.
Click the IIS 10.0 web server name.
Under "ASP.Net", double-click the "Session State" icon.
Under "Cookie Settings", verify the "Mode" has "Use Cookies" selected from the drop-down list.
If the "Cookie Settings" "Mode" is not set to "Use Cookies", this is a finding.

Alternative method:

Click the site name.
Select "Configuration Editor" under the "Management" section.
From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
Verify the "cookieless" is set to "UseCookies".
If the "cookieless" is not set to "UseCookies", this is a finding.

Note: If IIS 10.0 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.

Check Content Reference

M

Target Key

4052

Comments