6.2 (L2) Ensure 'Enable JavaScript' is 'Disabled'

Information

JavaScript enables web site authors to create enhanced user interfaces. In support of this, JavaScript enables web sites to programmatically read and alter the document object model (DOM) for the rendered web site as well as instantiate various objects, such as asynchronous XML HTTP request (XHR) objects. It is recommended that JavaScript be disabled.

Rationale:

JavaScript continues to be an attack vector for exploiting vulnerabilities in the browser. Additionally, JavaScript is commonly leveraged by exploit authors to create a deterministic memory layout in support of increasing the reliability of exploits.

Solution

Follow the below steps to set Enable JavaScript to Disabled:

1. Click Safari.
2. Click Preferences.
3. Click AutoFill.
4. Uncheck the Enable JavaScript checkbox.

To configure the plist follow the below steps:

1. Open the com.apple.Safari.plist.
2. Find the token <key>WebKitJavaScriptEnabled</key>
3. Ensure this token is immediately followed by <false/>

Default Value:
Enabled.

See Also

https://workbench.cisecurity.org/files/1822

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b.

Plugin: Unix

Control ID: 5c39846648fe4e2d83f2879d661632efc12f7e2e7b16ade5b9bc3563dda5f37d