Ensure 'Allow read access via the File System API on these sites' is set to 'Disabled'

MittelStufe 2Automatisiertedge

Beschreibung

This policy setting allows organizations to list the URL patterns that specify which sites can ask users to grant them read access to files or directories in the host operating system´s file system via the File System API. The recommended state for this setting is: Disabled. Rationale: This API allows web apps to read from files and folders on user devices. It also allows for the reading files and the File System Access API provides the ability to open a directory and enumerate its contents. The policy is Disabled when it is not present: the audit prints 'absent' when neither the value FileSystemReadAskForUrls nor a populated list subkey FileSystemReadAskForUrls exists under HKLM\SOFTWARE\Policies\Microsoft\Edge, otherwise the configured entries.

So wird geprüft

Prüfmethode: Windows-Registrierung

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\FileSystemReadAskForUrls' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge' -Name 'FileSystemReadAskForUrls' -ErrorAction SilentlyContinue).'FileSystemReadAskForUrls'; if ($null -eq $v -and $l.Count -eq 0) { 'absent' } else { 'configured: ' + (@($v) + $l -join ', ') }

Erwartete Ausgabe: absent

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Content settings\Allow read access via the File System API on these sites = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Microsoft\Edge\FileSystemReadAskForUrls after reviewing them.

Eigenschaften

Betriebssysteme: Beliebig
Tags: edgebrowsercis-l2
Referenz: CIS Microsoft Edge Benchmark v5.0.0 - 1.4.1 Ensure 'Allow read access via the File System API on these sites' is set to 'Disabled'

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target edge --level 2