ASP.NET Misconfiguration: Information Disclosure

C#/VB.NET/ASP.NET

Abstract

啟用 ASP.NET Web Service 適用的 Documentation 通訊協定可能會洩漏有關如何誤用該服務的資訊。

Explanation

ASP.NET Web 服務透過自動產生描述如何與 Web 服務通訊的文件來促進 Web 服務用戶端的開發。

當收到瀏覽器要求時，已啟用文件通訊協定的 Web 服務會產生 HTML 格式的頁面。

這個 HTML 格式的頁面描述以下資訊：
1.支援的操作
2.每個操作接受的參數
3.應該在這些參數中傳遞的資料類型

文件通訊協定還會產生一個 XML 格式的 Web 服務描述語言 (WSDL) 檔案。此檔案旨在讓應用程式瞭解如何架構對 Web 服務的要求。此資訊對開發人員非常有用，尤其是為公用 Web 服務建立用戶端的開發人員。但是，洩露有關私有 Web 服務功能的詳細資訊會增加 Web 服務被惡意攻擊者濫用的風險。文件通訊協定永遠會描述 Web 服務的所有功能和參數 - 即使只有這些功能的部分是有意設為可公開存取。

References

[1] HOW TO: Disable the Documentation Protocol for ASP.NET Web Services

[2] HOW TO: Limit the Web Services Protocols that a Server Permits

[3] Web.config

[4] Web Services Settings Schema

[5] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1

[6] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[7] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[8] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[9] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-002165

[10] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[11] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1)

[12] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement

[13] Standards Mapping - OWASP Top 10 2013 A2 Broken Authentication and Session Management

[14] Standards Mapping - OWASP Top 10 2017 A2 Broken Authentication

[15] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[16] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[17] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[18] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[19] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[20] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[21] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[24] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[33] Standards Mapping - Web Application Security Consortium Version 2.00 Fingerprinting (WASC-45)

desc.configuration.dotnet.asp_dotnet_misconfiguration_information_disclosure