Information
Disallowing all but the necessary file extensions can greatly reduce the attack surface of applications and servers.
Solution
The allowUnlisted Request Filter may be set for a server, website, or application using the IIS Manager GUI, using AppCmd.exe commands in a command-line window, and/or directly editing the configuration files. To configure at the server level using the IIS Manager GUI: Open Internet Information Services (IIS) Manager In the Connections pane, select the server In the Home pane, double-click Request Filtering Click Edit Feature Settings... in the Actions pane Under the General section, uncheck Allow unlisted file name extensions To set this Request Filter using an AppCmd.exe command, run the following command at an elevated command prompt: %windir%\system32\inetsrv\appcmd set config /section:requestfiltering /fileExtensions.allowunlisted:false