Ensure 'Control where security restrictions on insecure origins apply' is set to 'Disabled'

ВысокийУровень 1Автоматическаяedge

Описание

This policy setting allows for a specified list of origins (URLs) or hostname patterns (like "*.contoso.com") for which security restrictions on insecure origins don´t apply. Allowed origins for legacy applications that can´t deploy TLS or set up a staging server for internal web development so that developers can test features requiring secure contexts without having to deploy TLS on the staging server. Rationale: Insecure contexts should always be labeled as insecure. The policy is Disabled when it is not present: the audit prints 'absent' when neither the value OverrideSecurityRestrictionsOnInsecureOrigin nor a populated list subkey OverrideSecurityRestrictionsOnInsecureOrigin exists under HKLM\SOFTWARE\Policies\Microsoft\Edge, otherwise the configured entries.

Как проверяется

Метод проверки: Реестр Windows

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\OverrideSecurityRestrictionsOnInsecureOrigin' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge' -Name 'OverrideSecurityRestrictionsOnInsecureOrigin' -ErrorAction SilentlyContinue).'OverrideSecurityRestrictionsOnInsecureOrigin'; if ($null -eq $v -and $l.Count -eq 0) { 'absent' } else { 'configured: ' + (@($v) + $l -join ', ') }

Ожидаемый вывод: absent

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Control where security restrictions on insecure origins apply = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Microsoft\Edge\OverrideSecurityRestrictionsOnInsecureOrigin after reviewing them.

Свойства

Операционные системы: Любая
Теги: edgebrowsercis-l1
Источник: CIS Microsoft Edge Benchmark v5.0.0 - 1.85 Ensure 'Control where security restrictions on insecure origins apply' is set to 'Disabled'

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target edge