ASP.NET Deny missing from authorization rule on location

Description

The configuration file (web.config) of this web application contains an authorization section that is missing a deny rule. A deny rule is required to deny access to all the other users. ASP.NET includes by default an allow all rule that is evaluated last and if a deny rule is missing this allow all rule will be evaluated last.

This is an example of a vulnerable configuration:

<authorization>
  <allow users="admin"/>
</authorization>

Remediation

It's recommended to add a <strong>deny</strong> rule. This is an example of a safe configuration: <pre> &lt;authorization&gt; &lt;allow users=&quot;admin&quot;/&gt; &lt;deny users=&quot;*&quot;/&gt; &lt;/authorization&gt;</pre>

References

Related Vulnerabilities