Title

Automatic directory indexing must be disabled. (Cat II impact)

Discussion

To identify the type of web servers and versions software installed it is common for attackers to scan for icons or special content specific to the server type and version. A simple request like http://example.com/icons/apache_pb2.png may tell the attacker that the server is Apache 2.2 as shown below. The many icons are used primary for auto indexing, which is recommended to be disabled.

Check Content

Open the httpd.conf file. Search for an uncommented LoadModule autoindex_module directive statement. If this statement is found uncommented, this is a finding.

Fix Text

Disable the autoindex_module by adding a "#" in front of it within the httpd.conf file, and restarting the Apache httpd service.

Additional Identifiers

Rule ID: SV-36620r1_rule

Vulnerability ID: V-26368

Group Title: WA00515

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.