ASP.NET Misconfiguration: Information Disclosure

C#/VB.NET/ASP.NET

Abstract

ASP.NET Web 服务的文档协议已启用，这可能会泄露相关信息，从而导致滥用服务。

Explanation

ASP.NET Web 服务通过自动生成描述如何与 Web 服务通信的文档来加快 Web 服务客户端的开发。

当收到浏览器请求时，启用了文档协议的 Web 服务将生成 HTML 格式的页面。

此 HTML 格式的页面描述以下信息：
1.支持的操作
2.每个操作接受的参数
3.应该在这些参数中传递的数据类型

该文档协议还生成一个 XML 格式的 Web 服务描述语言 (WSDL) 文件。此文件旨在让应用程序了解如何构建对 Web 服务的请求。此信息对开发人员非常有用，尤其是为公共 Web 服务创建客户端的开发人员。但是，显示有关专用 Web 服务功能的详细信息会增加恶意攻击者滥用 Web 服务的风险。文档协议始终描述 Web 服务的所有函数和参数，即使只有这些函数的子集可供公开访问。

References

[1] HOW TO: Disable the Documentation Protocol for ASP.NET Web Services

[2] HOW TO: Limit the Web Services Protocols that a Server Permits

[3] Web.config

[4] Web Services Settings Schema

[5] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1.0

[6] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5.0

[7] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[8] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[9] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-002165

[10] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[11] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1)

[12] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement

[13] Standards Mapping - OWASP Top 10 2013 A2 Broken Authentication and Session Management

[14] Standards Mapping - OWASP Top 10 2017 A2 Broken Authentication

[15] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[16] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[17] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[18] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[19] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[20] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[21] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[24] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[33] Standards Mapping - Web Application Security Consortium Version 2.00 Fingerprinting (WASC-45)

desc.configuration.dotnet.asp_dotnet_misconfiguration_information_disclosure