0

I have a public SharePoint 2013 site with publishing feature as well as custom applications deployed. Recently we had a security audit on the server by and independent security analyst to identify potential vulnerabilities on the site. One of the suggestion from the auditor was related to the "NtfsDisable8dot3NameCreation" key in the registry. He suggested to disable 8.3 filename with a registry key.

The security auditor has identified registry key "NtfsDisable8dot3NameCreation" enabled in the server.

We have no idea what is this vulnerability and how it affects SharePoint based sites.

Has anyone tried this before to strengthen the internet-facing SharePoint?

Reference

Microsoft IIS tilde character “~” Vulnerability/Feature – Short File/Folder Name Disclosure

IIS Short File Name Disclosure is back! Is your server vulnerable

How to disable 8.3 file name creation on NTFS partitions

1

We have this disabled as this is marked as security risk. especially you are in external (public facing environment), it should be disabled. This will also give you performance improvement.

http://www.admin-enclave.com/en/articles/sharepoint/338-sharepoint-windows-os-hardening-disable-ntfs-8-dot-3.html

1

The vulnerability is "Tilde Directory Enumeration", which is caused by adding a tilde character "~" in a Get request, which could allow remote attackers to disclose File and Folder names. Technical details can be found in the research paper here --> https://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf

It is highly recommended to fix it in your case as the site is exposed to internet. As a workaround you can configure your WAF to discard web requests containing the tilde "~" character. But this is not a permanent solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.