Ensure IIS HTTP detailed errors are hidden from displaying remotely

MediaNivel 1Automatizadaiis

Descripción

A Web site's error pages are often set to show detailed error information for troubleshooting purposes during testing or initial deployment. To prevent unauthorized users from viewing this privileged information, detailed error pages must not be seen by remote users. This setting can be modified in the errorMode attribute setting for a Web site's error pages. httpErrors errorMode must be DetailedLocalOnly or Custom at server level and for every site. PowerShell 5.1 with the WebAdministration module; run elevated.

Cómo se verifica

Método de auditoría: Comando de shell

shell

Import-Module WebAdministration -ErrorAction Stop; $paths = @('MACHINE/WEBROOT/APPHOST') + @(Get-Website | ForEach-Object { "IIS:\Sites\$($_.Name)" }); $bad = @($paths | Where-Object { $c = Get-WebConfiguration -Filter 'system.webServer/httpErrors' -PSPath $_; [string]$c.errorMode -notin @('DetailedLocalOnly', 'Custom') }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/httpErrors -Name errorMode -Value DetailedLocalOnly

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: iisinformation-disclosure
Referencia: CIS Microsoft IIS 10 Benchmark v1.2.1 - 3.4 Ensure IIS HTTP detailed errors are hidden from displaying remotely

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target iis