The service.cnf file found in the _vti_pvt directory has the default permission settings which may lead to an unauthorized access to the file What are the steps to deny anonymous access to _vti_pvt directory iis7.


Not having yet identified the full ramifications of this but also not finding official word on the correct approach, I hesitate in recommending this. However, I addressed this vulnerability by disabling inheritance of the security privileges on the _vti_bin directory and removing the Everyone user object, which had Read privileges inherited from the root site directory.

I am using SharePoint Server 2013 SP1 and tested basic functionality in SharePoint Designer 2013 as well as access to the site through the browser (navigating and editing web part content), including uploading and editing files; no issues so far. Even the farm admin doesn't have access to the _vti_pvt directory through a web browser.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.