Help and Support

Article ID: 195291 - Last Review: July 3, 2008 - Revision: 5.0

How to disable #exec in Server-Side Include fles

View products that this article applies to.
This article was previously published under Q195291
We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 7.0 running on Microsoft Windows Server 2008. IIS 7.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:
http://www.microsoft.com/technet/security/prodtech/IIS.mspx (http://www.microsoft.com/technet/security/prodtech/IIS.mspx)
For more information about IIS 7.0, visit the following Microsoft Web site:
http://www.iis.net/default.aspx?tabid=1 (http://www.iis.net/default.aspx?tabid=1)
Expand all | Collapse all

SUMMARY

For security reasons, Web administrators may want to disable the #exec function in Server-Side Include (SSI) files.

MORE INFORMATION

Important This article contains information about editing the Microsoft Internet Information Server (IIS) metabase. Before you edit the metabase, make sure you understand how to restore it if a problem occurs. For information about how to do this, view the "Configuration Backup/Restore" Help topic in the Internet Information Server snap-in for the Microsoft Management Console (MMC).

Internet Information Server (IIS) versions 3.0 and later allow command- line or CGI programs to be executed, and their text output to be returned as Web output. This is accomplished through the use of Server-Side Include (SSI) commands. An example of this type of command is as follows: 
   <html>
   <html><title>SSI #exec Test</title></head>
   <body>
   <pre>
   <!--#exec cmd="cmd.exe /c dir"-->
   </pre>
   </body>
   </html>

This functionality is enabled by default for the entire Web server. Web administrators may want to disable this feature. This is accomplished by performing the following steps:
  1. On an IIS 4.0 computer with the Windows Script Host (WSH) installed, go to the following directory:

    <%SystemRoot%>\System32\Inetsrv\adminsamples
  2. To disable #exec for the entire Web server use the following:
    cscript adsutil.vbs set w3svc/SSIExecDisable 1
    -or-

    For a specific virtual directory, you can use the following:
    cscript adsutil.vbs set w3svc/xx/root/vv/SSIExecDisable 1
    Where xx = the instance of the Web server and vv = the virtual directory name.
Note This will not affect the #include command.
APPLIES TO
  • Microsoft Internet Information Services 6.0
  • Microsoft Internet Information Services 5.0
  • Microsoft Internet Information Server 4.0
Back to the top
Keywords: 
kbhowto KB195291

Get Help Now

Contact a support professional by E-mail, Online, or Phone

Article Translations