WA00515 W22 - Automatic directory indexing must be disabled.

Information

To identify the type of web servers and versions software installed it is common for attackers to scan for icons or special content specific to the server type and version. A simple request like http://example.com/icons/apache_pb2.png may tell the attacker that the server is Apache 2.2 as shown below. The many icons are used primary for auto indexing, which is recommended to be disabled.

Solution

Disable the autoindex_module by adding a '#' in front of it within the httpd.conf file, and restarting the Apache httpd service.

See Also

https://iasecontent.disa.mil/stigs/zip/U_Apache_2-2_WIN_V1R13_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a., CAT|II, Rule-ID|SV-33225r1_rule, STIG-ID|WA00515_W22, Vuln-ID|V-26368

Plugin: Windows

Control ID: d536c0e9a6cd6774e72ccbfc668988f03d97efca6dc69564761fe5de9fe705f2