Check: SRG-APP-000131-WSR-000051
Web Server SRG:
SRG-APP-000131-WSR-000051
(in versions v4 r2 through v2 r2)
Title
All web server files must be verified for their integrity (e.g., checksums and hashes) before becoming part of the production web server. (Cat II impact)
Discussion
Being able to verify that a patch, upgrade, certificate, etc., being added to the web server is unchanged from the producer of the file is essential for file validation and nonrepudiation of the information. The web server or hosting system must have a mechanism to verify that files, before installation, are valid. Examples of validation methods are sha1 and md5 hashes and checksums.
Check Content
Review the web server documentation and deployment configuration to determine if the web server validates files before the files are implemented into the running configuration. If the web server does not meet this requirement and an external facility is not available for use, this is a finding.
Fix Text
Configure the web server to verify object integrity before becoming part of the production web server or utilize an external tool designed to meet this requirement.
Additional Identifiers
Rule ID: SV-206372r984351_rule
Vulnerability ID: V-206372
Group Title: SRG-APP-000131
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001749 |
The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization. |
| CCI-003992 |
Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization. |
Controls
| Number | Title |
|---|---|
| CM-5(3) |
Signed Components |