Rule Definition
Be sure you trust the source of your metadata and make sure that no one has tampered with the metadata. Metadata retrieved using the HTTP protocol is sent in clear text and can be tampered with. If the service uses the HttpsGetEnabled and HttpsGetUrl properties, use the URL supplied by the service creator to download the data using the HTTPS protocol.

Remediation
Ensure you trust the source of your metadata by enabling HttpsGetEnalbled and HttpsGetUrl properties

Violation Code Sample

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
 <system.serviceModel>
  <behaviors>
   <serviceBehaviors>
    <behavior name="mySvcBehavior">
     <serviceMetadata httpsGetEnabled="false"/>
    </behavior>
   </serviceBehaviors>
  </behaviors>
 <services>
  <service behaviorConfiguration="mySvcBehavior"
        name="Microsoft.Security.Samples.Calculator">
   <endpoint address="http://localhost:8037/ServiceModelSamples/calculator"
   binding="wsHttpBinding" bindingConfiguration=""
   contract="Microsoft.Security.Samples.ICalculator" />
  </service>
 </services>
</system.serviceModel>
</configuration>

Fixed Code Sample

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
 <system.serviceModel>
  <behaviors>
   <serviceBehaviors>
    <behavior name="mySvcBehavior">
     <serviceMetadata httpsGetEnabled="true"
          httpsGetUrl="https://localhost:8036/calcMetadata" />
    </behavior>
   </serviceBehaviors>
  </behaviors>
 <services>
  <service behaviorConfiguration="mySvcBehavior"
        name="Microsoft.Security.Samples.Calculator">
   <endpoint address="http://localhost:8037/ServiceModelSamples/calculator"
   binding="wsHttpBinding" bindingConfiguration=""
   contract="Microsoft.Security.Samples.ICalculator" />
  </service>
 </services>
</system.serviceModel>
</configuration>

https://docs.microsoft.com/dotnet/framework/wcf/feature-details/best-practices-for-security-in-wcf#obtain-metadata-from-trusted-sources https://docs.microsoft.com/dotnet/framework/wcf/feature-details/how-to-secure-metadata-endpoints#to-create-a-secure-https-get-metadata-endpoint-in-configuration