WG400 W22 - All interactive programs must be placed in a designated directory with appropriate permissions.

Information

CGI scripts represents one of the most common and exploitable means of compromising a web server. By definition, CGI are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not otherwise limited unless the SA or Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs and use the network. CGI programs can be written in any available programming language. C, PERL, PHP, Javascript, VBScript and shell (sh, ksh, bash) are popular choices.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Enter the statement above into httpd.conf file for all web site root directories.

See Also

https://iasecontent.disa.mil/stigs/zip/U_Apache_2-2_WIN_V1R13_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, Rule-ID|SV-36644r1_rule, STIG-ID|WG400_W22, Vuln-ID|V-2228

Plugin: Windows

Control ID: d06c4e7a798a3983d84c0a79bc40defc63eeac73f017a0ac8f9bef77e4c0f1d6