This article will help resolve security HSTS vulnerability CVEs on IIS10. The steps apply to Windows Server 2016+, to help resolve multiple vulnerabilities, including CVE-2023-23915 CVE-2023-23914 CVE-2017-7789. There are a few ways to configure IIS, and the blog post will show how to set up HTTP response, and HTTP redirect for the SCOM web console role’d server(s).
Setting HSTS on IIS10 to resolve with Server2016 1609
Open PowerShell window as Admin
cd c:\windows\winsxs
gci wow64_microsoft-windows-iis-shared* | ft Name
Example aim for latest directory
NOTE bottom entry based on software versioning
Example output
PS C:\windows\winsxs> gci wow64_microsoft-windows-iis-shared* | ft Name
Name
—-
wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.14393.0_none_48b28891ffe5bdae
wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.14393.1613_none_90c5a57843ef1621
wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.14393.5246_none_90f3a94643cc33e1
# AppCMD lines
.\appcmd.exe set config -section:system.applicationHost/sites “/[name=’Default Web Site’].hsts.enabled:True” /commit:apphost
.\appcmd.exe set config -section:system.applicationHost/sites “/[name=’Default Web Site’].hsts.max-age:31536000” /commit:apphost
.\appcmd.exe set config -section:system.applicationHost/sites “/[name=’Default Web Site’].hsts.includeSubDomains:True” /commit:apphost
.\appcmd.exe set config -section:system.applicationHost/sites “/[name=’Default Web Site’].hsts.redirectHttpToHttps:True” /commit:apphost
For Server2016 1709 and greater
To add the HSTS Header, follow the steps below:
Open IIS manager.
Select your site.
Open HTTP Response Headers option.
Click on Add in the Actions section.
In the Add Custom HTTP Response Header dialog, add the following values:
Name: Strict-Transport-Security
Value: max-age=31536000; includeSubDomains; preload
Or directly in web.config as below under system.webServer:
<httpProtocol>
<customHeaders>
<add name=”Strict-Transport-Security” value=”max-age=31536000; includeSubDomains; preload” />
</customHeaders>
</httpProtocol>
NOTE iisreset may be required to restart IIS and apply settings
Verify HTTP Response Headers
From IIS10 (IIS Manager) > click on ‘Default Web Site’ > HTTP Response Headers
Verify Strict-Transport-Security blurb matches
Set HTTP Redirect
Now to set the HTTP redirect, to prevent denial of service (DoS) attacks.
From IIS10 (IIS Manager) > Expand ‘Default Web Site’ > HTTP Redirect
Screenshot
From IIS10 (IIS Manager) > Expand ‘Default Web Site’ > go through each Application to set HTTP redirect
Screenshot
Test your web console URL to verify components
References
NIST CVE-2023-23915 CVE-2023-23914
Mitre CVE-2017-7789