Rule Definition
Be sure you trust the source of your metadata and make sure that no one has tampered with the metadata. Metadata retrieved using the HTTP protocol is sent in clear text and can be tampered with. If the service uses the HttpsGetEnabled and HttpsGetUrl properties, use the URL supplied by the service creator to download the data using the HTTPS protocol.

Remediation
Ensure you trust the source of your metadata by enabling HttpsGetEnalbled and HttpsGetUrl properties

Violation Code Sample

// Create a new metadata behavior object and set its properties to
// create a secure endpoint.
ServiceMetadataBehavior sb = new ServiceMetadataBehavior();
sb.HttpsGetEnabled = false;
myServiceHost.Description.Behaviors.Add(sb);

myServiceHost.Open();

Fixed Code Sample

// Create a new metadata behavior object and set its properties to
// create a secure endpoint.
ServiceMetadataBehavior sb = new ServiceMetadataBehavior();
sb.HttpsGetEnabled = true;
sb.HttpsGetUrl = new Uri("https://myMachineName:8036/myEndpoint");
myServiceHost.Description.Behaviors.Add(sb);

myServiceHost.Open();

https://docs.microsoft.com/dotnet/framework/wcf/feature-details/best-practices-for-security-in-wcf#obtain-metadata-from-trusted-sources https://docs.microsoft.com/dotnet/framework/wcf/feature-details/how-to-secure-metadata-endpoints