Ensure ASP.NET stack tracing is not enabled

BajaNivel 2Automatizadaiis

Descripción

The trace element configures the ASP.NET code tracing service that controls how trace results are gathered, stored, and displayed. When tracing is enabled, each page request generates trace messages that can be appended to the page output or stored in an application trace log. ASP.NET trace must not be enabled in the root web.config or any site (page-level Trace="true" is not checked). PowerShell 5.1 with the WebAdministration module; run elevated.

Cómo se verifica

Método de auditoría: Comando de shell

shell

Import-Module WebAdministration -ErrorAction Stop; $paths = @('MACHINE/WEBROOT') + @(Get-Website | ForEach-Object { "IIS:\Sites\$($_.Name)" }); $bad = @($paths | Where-Object { $c = Get-WebConfiguration -Filter 'system.web/trace' -PSPath $_; $c.enabled -eq $true }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST/<site>' -Filter system.web/trace -Name enabled -Value False

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: iisinformation-disclosure
Referencia: CIS Microsoft IIS 10 Benchmark v1.2.1 - 3.5 Ensure ASP.NET stack tracing is not enabled

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target iis --level 2