Ensure IIS HTTP detailed errors are hidden from displaying remotely

中级别 1自动化iis

说明

A Web site's error pages are often set to show detailed error information for troubleshooting purposes during testing or initial deployment. To prevent unauthorized users from viewing this privileged information, detailed error pages must not be seen by remote users. This setting can be modified in the errorMode attribute setting for a Web site's error pages. httpErrors errorMode must be DetailedLocalOnly or Custom at server level and for every site. PowerShell 5.1 with the WebAdministration module; run elevated.

检查方式

审计方法: Shell 命令

shell

Import-Module WebAdministration -ErrorAction Stop; $paths = @('MACHINE/WEBROOT/APPHOST') + @(Get-Website | ForEach-Object { "IIS:\Sites\$($_.Name)" }); $bad = @($paths | Where-Object { $c = Get-WebConfiguration -Filter 'system.webServer/httpErrors' -PSPath $_; [string]$c.errorMode -notin @('DetailedLocalOnly', 'Custom') }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/httpErrors -Name errorMode -Value DetailedLocalOnly

属性

操作系统: 任意
标签: iisinformation-disclosure
参考: CIS Microsoft IIS 10 Benchmark v1.2.1 - 3.4 Ensure IIS HTTP detailed errors are hidden from displaying remotely

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target iis