TMA-CHROME-1.25
Ensure 'List of names that will bypass the HSTS policy check' is set to 'Disabled'
Mô tả
This setting allows a list of names to be specified that will be exempt from HTTP Strict Transport Security (HSTS) policy checks, then potentially upgraded from http:// to https://. The recommended state for this setting is: Disabled (0) Rationale: Allowing hostnames to be exempt from HSTS checks could allow for protocol downgrade attacks and cookie hijackings. The policy is Disabled when it is not present: the audit prints 'absent' when the list key HKLM\SOFTWARE\Policies\Google\Chrome\HSTSPolicyBypassList is missing or empty, otherwise the configured entries.
Cách kiểm tra
Phương pháp kiểm tra: Windows Registry
$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\HSTSPolicyBypassList' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); if ($l.Count -eq 0) { 'absent' } else { 'configured: ' + ($l -join ', ') }- Đầu ra mong đợi
absent
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\List of names that will bypass the HSTS policy check = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Google\Chrome\HSTSPolicyBypassList after reviewing them.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- chromebrowsercis-l1
- Tham chiếu
- CIS Google Chrome Benchmark v3.0.0 - 1.25 Ensure 'List of names that will bypass the HSTS policy check' is set to 'Disabled'
Kiểm tra máy này
Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.
tmaegis scan --target chrome