TMA-IIS-4.3
Ensure 'MaxQueryString request filter' is configured
Beschreibung
The MaxQueryString Request Filter describes the upper limit on the length of the query string that the configured IIS server will allow for websites or applications. It is recommended that values always be established to limit the amount of data that can be accepted in the query string. requestLimits maxQueryString must be 2048 or lower at server level and for every site (default 2048). PowerShell 5.1 with the WebAdministration module; run elevated.
So wird geprüft
Prüfmethode: Shell-Befehl
Import-Module WebAdministration -ErrorAction Stop; $paths = @('MACHINE/WEBROOT/APPHOST') + @(Get-Website | ForEach-Object { "IIS:\Sites\$($_.Name)" }); $bad = @($paths | Where-Object { $c = Get-WebConfiguration -Filter 'system.webServer/security/requestFiltering/requestLimits' -PSPath $_; [long]$c.maxQueryString -gt 2048 }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/security/requestFiltering/requestLimits -Name maxQueryString -Value 2048
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- iisrequest-filtering
- Referenz
- CIS Microsoft IIS 10 Benchmark v1.2.1 - 4.3 Ensure 'MaxQueryString request filter' is configured
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target iis --level 2