← Back to Microsoft IIS 10.0 Site Security Technical Implementation Guide

V-218755

CAT II (Medium)

The IIS 10.0 websites Maximum Query String limit must be configured.

Rule ID

SV-218755r961152_rule

STIG

Microsoft IIS 10.0 Site Security Technical Implementation Guide

Version

V2R15

CCIs

CCI-001094

Discussion

Setting limits on web requests helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The Maximum Query String Request Filter describes the upper limit on allowable query string lengths. Upon exceeding the configured value, IIS will generate a Status Code 404.15.

Check Content

Follow the procedures below for each site hosted on the IIS 10.0 web server:

Open the IIS 10.0 Manager.

Click the site name.

Double-click the "Request Filtering" icon.

Click “Edit Feature Settings” in the "Actions" pane.

If the "Maximum Query String" value is not set to "2048" or less, this is a finding.

Fix Text

Follow the procedures below for each site hosted on the IIS 10.0 web server:

Open the IIS 10.0 Manager.

Click the site name under review.

Double-click the "Request Filtering" icon.

Click "Edit Feature Settings" in the "Actions" pane.

Set the "Maximum Query String" value to "2048" or less.