MVC Application Security Issues: Software Information & Header Sensitive Data - Part Two

Background

In my previous article, I’ve explained what are the different types of third party attacks possible during client-server request/response exchanges. We also concluded why we need our website to run on “HTTPS” instead of “HTTP”, also we’ve seen the need of SSL enabled environment.

In this article, we will go one step up and will cover scenarios which are related to software information (could be version or framework or language information). If a third party person senses this information, he will manipulate user’s sensitive data with the help of protocols/syntax used in that particular technology or used in that particular software version.



Problem (Software Specific Information visible to end user)

Developer can use any technology to develop a website, could be JSP, Servlets, ASP.Net MVC etc., if I give an example say X developer is using ASP.Net MVC to build a website. Now, when we deploy a website into production, the assemblies (assembly information & other attributes) which have been deployed with “Debug” mode would be different from those deployed with “Release” mode. But, if you observe the headers during the process of request – response, you will find the sensitive information in the request/response header.

When client requests the data from server, server returns response header which contains ASP.Net MVC version, IIS/server version along with several other fields. So, third party attacker senses the information & that information can be used to search the pattern or syntax, specific to that version/framework. This increases the chances of an attack & also an attacker can plan a more focused attack on the application.

If you use Google Chrome, debug the browser pressing F12 which opens “Inspect Element” window. Refresh the page, you will observe the following in Network tab –

Headers

• Server: Microsoft-IIS/7.5
• X-AspNetMvc-Version: 4.0
• X-AspNet-Version: 4.0.30319

Solution



If the response header returns information about MVC version number say, MVC 4, attacker would know the MVC protocols to call controller and invoke Action corresponding to that controller, and he will plan accordingly. To avoid this situation, we need to remove the unwanted HTTP header field values from the response. Following are the three response header values which we may want to remove for security reasons –

1. Server – Indicates which web server version is used.
2. X-Powered-By – Indicates the website is powered by which? Like, “powered by ASP.Net.”
3. X-aspnet-Version – Indicates the version of ASP.Net is Used.

URL Rewrite

Developer can use the URL Rewrite module to remove the unnecessary values from server header. Please make a note – This tool won’t remove the actual header field, it will only remove the values contain by the header.

How to do

Step 1: Install URL Rewrite. You can use this URL to download & install into IIS.

Step 2: In IIS, in the left panel, click on the website you want to remove the server headers from, after click on that, at the right side, you will see the “URL Rewrite” option, click on that option.



Step 3: Inside that option, click on “View Server Variables” in the Actions pane at the right hand side.



Step 4: Click on the Add button at the right hand side, and then enter “RESPONSE_SERVER” in the given textbox.



Step 5: After this configuration, an “outbound rule” needs to be created.

In Web.config file, we need to include following section under configuration->system.webServer element: