Title

Anonymous FTP users must not have access to interactive scripts. (Cat II impact)

Discussion

The directories containing the CGI scripts, such as PERL, must not be accessible to anonymous users via FTP. This applies to all directories containing scripts that can dynamically produce web pages in an interactive manner (i.e., scripts based upon user-provided input). Such scripts contain information that could be used to compromise a web service, access system resources, or deface a web site.

Check Content

1. Open the IIS Manager. 2. For the site being reviewed, determine the directories where CGI, PERL, ASP, JS, or JSP scripts are located. 3. Determine if these locations are enabled for FTP access by looking under the FTP Sites folder within IIS Manager. 4. For directories with FTP enabled, right click on the directory > Select Properties > Select Directory Security > Select the Edit button beside Authentication and access control. If Enable anonymous access is checked, this is a finding.

Fix Text

Remove anonymous FTP access from directories where CGI, PERL, ASP, JS, or JSP scripts are located.

Additional Identifiers

Rule ID: SV-38111r1_rule

Vulnerability ID: V-2270

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.