Microsoft SharePoint Server
TMA-SHAREPOINT-3.6
Ensure that SharePoint is configured with "Strict" browser file handling settings
MediumLevel 1Automatedsharepoint
Description
SharePoint must prevent the execution of prohibited mobile code. Prints the number of web applications whose BrowserFileHandling is not Strict (expected 0). Run on a SharePoint farm server as a farm administrator; the audit loads the Microsoft.SharePoint.PowerShell snap-in and fails if it cannot.
How it is checked
Audit method: Shell command
shell
$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop }; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { throw 'SharePoint cmdlets are not available' }; $bad = @(Get-SPWebApplication -ErrorAction Stop | Where-Object { "$($_.BrowserFileHandling)" -ne 'Strict' }); $bad.Count- Expected output
0
How it is fixed
Fix method: Guidance or infrastructure patch
Central Administration > Manage Web Applications > General Settings > Browser File Handling: Strict (or $wa = Get-SPWebApplication <url>; $wa.BrowserFileHandling = 'Strict'; $wa.Update()).
Properties
- Operating systems
- Any
- Tags
- sharepointweb-applications
- Reference
- CIS Microsoft SharePoint 2019 Benchmark v1.0.0 - 3.6 Ensure that SharePoint is configured with "Strict" browser file handling settings
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target sharepoint