Detections
Analytics
IIST-SV-000220 - The Request Smuggling filter must be enabled.
Information
Security scans show Request Smuggling vulnerability on IIS server.The vulnerability allows a remote attacker to perform HTTP request smuggling attack.
The vulnerability exists due to the way that HTTP proxies (front-end) and web servers (back-end) that do not strictly adhere to RFC standards handle sequences of HTTP requests received from multiple sources. A remote attacker can send a specially crafted request to a targeted IIS Server, perform HTTP request smuggling attack and modify responses or retrieve information from another user's HTTP session.
Solution
Navigate to 'HKLM\System\CurrentControlSet\Services\HTTP\Parameters'.Create REG_DWORD 'DisableRequestSmuggling' and set it to '1'.
Note: This can be performed multiple ways; this is an example.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_IIS_10-0_Y26M07_STIG.zip
Item Details
Audit Name: DISA Microsoft IIS 10.0 Server STIG v3r7
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-7a., CAT|II, CCI|CCI-000381, Rule-ID|SV-268325r1025163_rule, STIG-ID|IIST-SV-000220, STIG-Legacy|SV-109223, STIG-Legacy|V-100119, Vuln-ID|V-268325
Plugin: Windows
Control ID: 4a865414361e18bc8376f538c9a56dc955ee23f8fa763242c0e8ce307a0a9c6b