Check: AS24-W2-000350
Apache Server 2.4 Windows Site STIG:
AS24-W2-000350
(in versions v2 r1 through v1 r2)
Title
Users and scripts running on behalf of users must be contained to the document root or home directory tree of the Apache web server. (Cat II impact)
Discussion
A web server is designed to deliver content and execute scripts or applications on the request of a client or user. Containing user requests to files in the directory tree of the hosted web application and limiting the execution of scripts and applications guarantees that the user is not accessing information protected outside the application's realm. The web server must also prohibit users from jumping outside the hosted application directory tree through access to the user's home directory, symbolic links or shortcuts, or through search paths for missing files.
Check Content
Review the <'INSTALLED PATH'>\conf\httpd.conf file and search for the following directive: Directory For every root directory entry (i.e., <Directory />), verify the following exists. If it does not, this is a finding: Require all denied If the statement above is not found in the root directory statement, this is a finding.
Fix Text
Edit the <'INSTALLED PATH'>\conf\httpd.conf file and set the root directory directive as follows: Directory Require all denied
Additional Identifiers
Rule ID: SV-214368r395853_rule
Vulnerability ID: V-214368
Group Title: SRG-APP-000141-WSR-000087
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000381 |
The organization configures the information system to provide only essential capabilities. |
Controls
Number | Title |
---|---|
CM-7 |
Least Functionality |