V-2270
Anonymous FTP users must not have access to interactive scripts.
Discussion
The directories containing the CGI scripts, such as PERL, must not be accessible to anonymous users via FTP. This applies to all directories containing scripts that can dynamically produce web pages in an interactive manner (i.e., scripts based upon user-provided input). Such scripts contain information that could be used to compromise a web service, access system resources, or deface a web site.
Fix Text
Remove anonymous FTP access from directories where CGI, PERL, ASP, JS, or JSP scripts are located.
Check Content
1. Open the IIS Manager. 2. For the site being reviewed, determine the directories where CGI, PERL, ASP, JS, or JSP scripts are located. 3. Determine if these locations are enabled for FTP access by looking under the FTP Sites folder within IIS Manager. 4. For directories with FTP enabled, right click on the directory > Select Properties > Select Directory Security > Select the Edit button beside Authentication and access control. If Enable anonymous access is checked, this is a finding.
Responsibility
System Administrator
IA Controls
ECCD-1, ECCD-2