documentation_complete: true

title: 'Disable Server Side Includes'

description: |-
    Server Side Includes provide a method of dynamically generating web pages through the
    insertion of server-side code. However, the technology is also deprecated and
    introduces significant security concerns.
    If this functionality is unnecessary, comment out the related module:
    <pre>#LoadModule include_module modules/mod_include.so</pre>
    If there is a critical need for Server Side Includes, they should be enabled with the
    option <tt>IncludesNoExec</tt> to prevent arbitrary code execution. Additionally, user
    supplied data should be encoded to prevent cross-site scripting vulnerabilities.

rationale: |-
    Minimizing the number of loadable modules available to the web server reduces risk
    by limiting the capabilities allowed by the web server.

severity: unknown

identifiers:
    cce: 27558-6
