.NET配置檔案的10大安全漏洞

在ASP.NET應用程式在生產環境中部署時，需要檢查Web.Config檔案是否存在以下10個不正確的配置，可能導致安全漏洞：

 

1、Disabling custom errors      

Vulnerable:                               Secure:

<configuration>                          <configuration>

<system.web>                           <system.web>

<custom mode=”Off”>                      <customErrors mode=”RemoteOnly”>

 

2、Leaving tracing enabled

Vulnerable:                               Secure:

<configuration>                          <configuration>

<system.web>                                   <system.web>

<trace enabled=”true”                 <trace enabled=”false”

localOnly=”false”>                      localOnly=”true”>

 

3、Enabling debugging

Vulnerable:                               Secure:

<configuration>                          <configuration>

<system.web>                                   <system.web>

<compilation debug=”true”>        <compilation debug=”false”>

 

4、Making cookies accessible through client-side script

Vulnerable:                               Secure:

<configuration>                          <configuration>

<system.web>                           <system.web>

<httpCookies                              <httpCookies

httpOnlyCookies=”false”>           httpOnlyCookies=”true”>

 

5、Enabling cookieless session state

Vulnerable:                               Secure:

<configuration>                          <configuration>

<system.web>                                   <system.web>

<sessionState                              <sessionState

cookieless=”UseUri”>                 cookieless=”UseCookies”>

 

6、Enabling cookieless authentication

Vulnerable:                                      Secure:

<configuration>                                 <configuration>

<system.web>                                  <system.web>

<authentication mode=”Forms”>         <authentication mode=”Forms”>

<forms cookieless=”UseUri”>             <forms cookieless=”UseCookies”>

 

7、Failing to require SSL for authentication cookies

Vulnerable:                                      Secure:

<configuration>                                 <configuration>

<system.web>                                  <system.web>

<authentication mode=”Forms”>         <authentication mode=”Forms”>

<forms requireSSL=”false”>               <forms requireSSL=”true”>

 

8、Using sliding expiration

Vulnerable:                                      Secure:

<configuration>                                 <configuration>

<system.web>                                  <system.web>

<authentication mode=”Forms”>         <authentication mode=”Forms”>

<forms slidingExpiration=”true”>        <forms slidingExpiration=”false”>

 

9、Using non-unique authentication cookies

Vulnerable:                                      Secure:

<configuration>                                 <configuration>

<system.web>                                  <system.web>

<authentication mode=”Forms”>         <authentication mode=”Forms”>

<forms name=”.ASPXAUTH”>           <forms name=”{abcd1234…}”

 

10、Using hard-coded credentials

Vulnerable:                                      Secure:

<configuration>                                 <configuration>

<system.web>                                  <system.web>

<authentication mode=”Forms”>         <authentication mode=”Forms”>

<forms>                                                  <forms>

<credentials>                                           …

…

</credentials>                                   </forms>

</forms>

 

 

參考：《Top 10 security vulnerabilities in .NET configuration files》