1.3.5 Ensure 'Control use of the File System API for reading' is set to 'Enabled: Don't allow any site to request read access to files and directories'

Information

This policy setting determines whether websites can ask for read access to the host operating system's file system using the File System API.

Policy options mapping:

BlockFileSystemRead (2) = Don't allow any site to request read access to files and directories via the File System API

AskFileSystemRead (3) = Allow sites to ask the user to grant read access to files and directories via the File System API

The recommended state for this setting is: Enabled: Don't allow any site to request read access to files and directories.

Rationale:

There is a large category of attack vectors that are opened up by allowing web applications access to files. By setting this policy to Enabled: Don't allow any site to request read access to files and directories implements additional protections to safeguard against accidental sharing of sensitive information contained in locals files.

Impact:

Users with creative roles that require the File System API access permission to read files for photo, video, and text editors or for creating integrated development environments will need additional permissions granted based on their role.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled: Don't allow any site to request read access to files and directories:

Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Content settings\Control use of the File System API for reading

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template MSEdge.admx/adml that can be downloaded from: Download Microsoft Edge for Business - Microsoft.

Default Value:

AskFileSystemRead (3) = Allow sites to ask the user to grant read access to files and directories via the File System API. (Websites can ask for access. Users can change this setting.)

See Also

https://workbench.cisecurity.org/benchmarks/11865

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CM-10, 800-53|CM-11, 800-53|SC-18, CSCv7|7.2

Plugin: Windows

Control ID: 371b8db035eb5bf2fa51b32a83bc4c9006a933b0fd6835bc1ff61bfeb8fc1b46