Ensure 'Configure the list of names that will bypass the HSTS policy check' is set to 'Disabled'

CaoCấp 1Tự độngedge

Mô tả

This policy setting allows a list of names to be specified that will be exempt from HTTP Strict Transport Security (HSTS) policy checks then potentially upgraded from http:// to https://. The recommended state for this setting is: Disabled. Rationale: Allowing hostnames to be exempt from HSTS policy checks could allow for protocol downgrade attacks and cookie hijackings. The policy is Disabled when it is not present: the audit prints 'absent' when neither the value HSTSPolicyBypassList nor a populated list subkey HSTSPolicyBypassList exists under HKLM\SOFTWARE\Policies\Microsoft\Edge, otherwise the configured entries.

Cách kiểm tra

Phương pháp kiểm tra: Windows Registry

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\HSTSPolicyBypassList' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge' -Name 'HSTSPolicyBypassList' -ErrorAction SilentlyContinue).'HSTSPolicyBypassList'; if ($null -eq $v -and $l.Count -eq 0) { 'absent' } else { 'configured: ' + (@($v) + $l -join ', ') }

Đầu ra mong đợi: absent

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Configure the list of names that will bypass the HSTS policy check = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Microsoft\Edge\HSTSPolicyBypassList after reviewing them.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: edgebrowsercis-l1
Tham chiếu: CIS Microsoft Edge Benchmark v5.0.0 - 1.78 Ensure 'Configure the list of names that will bypass the HSTS policy check' is set to 'Disabled'

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target edge