Exposed Localstart.asp Page

medium Web App Scanning Plugin ID 98088

Language:

Synopsis

Description

To restrict access to specific pages on a webserver, developers can implement various methods of authentication, therefore only allowing access to clients with valid credentials. There are several forms of authentication that can be used. The simplest forms of authentication are known as 'Basic' and 'Basic Realm'. These methods of authentication have several known weaknesses such as being susceptible to brute force attacks.

Additionally, when utilising the NTLM mechanism in a windows environment, several disclosures of information exist, and any brute force attack occurs against the server's local users, or domain users if the web server is a domain member.

Cyber-criminals will attempt to locate protected pages to gain access to them and also perform brute force attacks to discover valid credentials.

Scanner discovered the following page requires NTLM based basic authentication in order to be accessed.

Solution

If the pages being protected are not required for the functionality of the web application they should be removed, otherwise, it is recommended that basic and basic realm authentication are not used to protect against pages requiring authentication.
If NTLM based basic authentication must be used, then default server and domain accounts such as `administrator` and `root` should be disabled, as these will undoubtedly be the first accounts to be targeted in any such attack.
Additionally, the webserver should not be joined to any corporate domain where usernames are readily available (such as from email addresses). If the pages are required, and it is possible to remove the basic authentication, then a stronger and more resilient form-based authentication mechanism should be implemented to protect the affected pages.