1.7 Ensure' WebDav' feature is disabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

WebDAV is an extension to the HTTP protocol which allows clients to create, move, and delete files and resources on the web server.

Note: The WebDAV feature must be enabled for this functionality to be available in IIS.

Rationale:

WebDAV is not widely used, and it has serious security concerns because it may allow clients to modify unauthorized files on the web server. Therefore, the WebDav feature should be disabled.

Impact:

The WebDav feature will not be available in IIS.

Solution

To disable this feature using PowerShell, enter the following command:

Uninstall-WindowsFeature Web-DAV-Publishing

Verify that Success is True

Default Value:

The default state of WebDAV Publishing is disabled

See Also

https://workbench.cisecurity.org/files/4131