IIS short File Vulnerability repair

IIS short File Vulnerability repair

Recently, the website system has been scanned for a vulnerability: IIS short files/folders.

Vulnerability level: medium-risk vulnerability address: All websites

Vulnerability Description: IIS short file name leakage vulnerability. The file enumeration vulnerability exists in IIS. Attackers can exploit this vulnerability to obtain files in the root directory of the server.

Hazards: attackers can exploit "~" It can be used to guess or traverse the file name on the server, or initiate a Denial-of-Service attack on the. Net Framework in the IIS server.

Cause: NTFS8.3 file name creation is not prohibited.

Vulnerability:

I have found a lot of information on the Internet that has not achieved the repair effect. I suggest you use it on the Internet. net Farrmework upgraded to 4.0 to fix this vulnerability. However, the system framework is version 4.0 and the vulnerability still exists after being scanned.

Combine the data to organize the repair solution:

1. Modify the registry key: (restart the server to take effect)

HKLM \ SYSTEM \ CurrentControlSet \ Control \ FileSystem \ NtfsDisable8dot3NameCreation

The value is 1.

2. Execute the doscommand, fsutil behavior set disable8dot3 1

3. Delete the existing IIS directory and redeploy it. This step can be completely repaired.

This operation has been performed for Security penetration scanning, and no iis short File Vulnerability is found.