4.5 Ensure Double-Encoded requests will be rejected - Applications

Information

This Request Filter feature prevents attacks that rely on double-encoded requests and applies if an attacker submits a double-encoded request to IIS. When the double-encoded requests filter is enabled, IIS will go through a two iteration process of normalizing the request. If the first normalization differs from the second, the request is rejected and the error code is logged as a 404.11. The double-encoded requests filter was the VerifyNormalization option in UrlScan.

It is recommended that double-encoded requests be rejected.

Rationale:

This feature will help prevent attacks that rely on URLs that have been crafted to contain double-encoded request(s).

Impact:

Double-encoded requests will be rejected.

Solution

The allowDoubleEscaping Request Filter may be set for a server, website, or application using the IIS Manager GUI, using AppCmd.exe commands in a command-line window, and/or directly editing the configuration files. To configure using the IIS Manager GUI:

Open Internet Information Services (IIS) Manager

In the Connections pane, select the site, application, or directory to be configured

In the Home pane, double-click Request Filtering

Click Edit Feature Settings... in the Actions pane

Under the General section, uncheck Allow double escaping

If a file name in a URL includes '+' then allowDoubleEscaping must be set to true to allow functionality.

Enter the following command in AppCmd.exe to configure:

%systemroot%\system32\inetsrv\appcmd set config /section:requestfiltering /allowDoubleEscaping:false

OR

Enter the following command in PowerShell to configure:

Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter 'system.webServer/security/requestFiltering' -name 'allowDoubleEscaping' -value 'True'

Default Value:

When Request Filtering is installed on a system, the default behavior is to not allow double-encoded requests.

See Also

https://workbench.cisecurity.org/benchmarks/13949

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-16, CSCv7|18

Plugin: Windows

Control ID: 686410bd3c5656f3513293293f3758c493d2e6b7c175e2e1d07540ec83e7bd07