1.7 Ensure' WebDav' feature is disabled

Information

WebDAV is an extension to the HTTP protocol which allows clients to create, move, and delete files and resources on the web server.

Note: The WebDAV feature must be enabled for this functionality to be available in IIS.

Rationale:

WebDAV is not widely used, and it has serious security concerns because it may allow clients to modify unauthorized files on the web server. Therefore, the WebDav feature should be disabled.

Impact:

The WebDav feature will not be available in IIS.

Solution

To disable this feature using PowerShell, enter the following command:

Uninstall-WindowsFeature Web-DAV-Publishing

Verify that Success is True

Default Value:

The default state of WebDAV Publishing is disabled

See Also

https://workbench.cisecurity.org/benchmarks/13949

Item Details

Category: CONFIGURATION MANAGEMENT, PLANNING, SYSTEM AND SERVICES ACQUISITION

References: 800-53|CM-6, 800-53|CM-7, 800-53|PL-8, 800-53|SA-8, CSCv7|9.2

Plugin: Windows

Control ID: 9861a139156eb8b78b5374ad8e688d0ea302a79382721cbfb7c932041cd73a4c