ASP.NET WCF replay attacks are not detected

Description

This web application is configured with the localServiceSettings property detectReplays set to false. When configured this way, the WCF service is not protected against replay attacks (replaying messages between the client and service or vice versa).

Remediation

It's recommended to enable message replay detection by setting the <strong>localServiceSettings</strong> property <strong>detectReplays</strong> to <strong>true</strong>. <pre> &lt;localServiceSettings detectReplays=&quot;true&quot; /&gt; </pre>

References

Related Vulnerabilities