Information
The iisWasKey is intended for access only by Administrators and SYSTEM. Since the IIS_IUSRS group is granted read access, an attacker compromising an application set to use a principal in the IIS_IUSRS group could potentially gain access to the encryption key(s). Revoking this unnecessary privilege will reduce attack surface and help maintain confidentiality and system/application integrity.
NOTE : Nessus has not performed this query, and this check is only provided for informational purposes.
Solution
Removing access to the iisWasKey can be done by using an aspnet_regiis.exe command. The syntax is as follows, and is dependent on the version of .NET being used: %systemroot%\Microsoft.NET\Framework\\aspnet_regiis.exe -pr iisWasKey IIS_IUSRS To remove read access to the IIS_IUSRS security group on a system using .NET Framework v2.0: Open an elevated command prompt Run the following aspnet_regiis.exe command: %systemroot%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe -pr iisWasKey IIS_IUSRS If running a 64-bit system, also run the following: %systemroot%\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe -pr iisWasKey IIS_IUSRS Note: A unique version of aspnet_regiis.exe is included with each version of the .NET Framework. Since each version of the tool applies only to its associated version of the .NET Framework, be sure to use the appropriate version of the tool.