0

Environment:

  • web and app servers are Windows Server 2003 Enterprise / IIS 6
  • Web Server is behind a firewall - ports 80 and 443 are open to the world.
  • Between the WebServer and the AppServer traffic goes through a firewall and only port 80 is open
  • The webserver external website makes calls to WCF services on the app server. These WCF service calls are completely unauthenticated - but perform very critical data updates to a database server.

I assume (correct me if I'm wrong) that compromising the webserver would require an attack along port 443 or 80 from the outside world - thus it would require an IIS exploit to compromise the server.

Questions:

  1. How bad is this configuration when dealing with critical data?
  2. If the webserver is compromised, is there anything that can be done to mitigate its impact and for most scenarios prevent arbitrary invocation of the WCF services?
  3. Is there a list of the "typical" impacts of historic IIS vulnerabilities?
Improve this question

2 Answers 2

Reset to default
1

Ensuring that domain and server isolation is set up will secure the traffic between the 2 servers. As long as your developer is using the proper injection prevention techniques, The only way I could see being able to invoke the WCF would be though a remote code execution vulnerability. There aren't too many of those and even if unpatched I think they all use the same rights as your worker process identity (which according to best practice should be locked down).

I would highly reccomend that you take a look at the WCF security guidelines from the patterns and practices group, It's pretty easy to implement security for WCF (simple message signing comes to mind) that would not require that the traffic be authenticated (however domain and server isolation automagically implements that without impact to the application)

Improve this answer
2
  • Doesn't the worker process identity have access to invoke the WCF Services by necessity? In that case, from a remote code execution vulnerability standpoint is anything really gained from authenticating the WCF services?
    – Nathan
    Dec 30, 2009 at 16:02
  • no, the worker process identity has the ability to send messages, assuming the server is compromised somehow, the best an attacker can do is send an unsigned message since he would have to be able to know how to invoke the applications code to correctly send a signed message. Regardless of platform, if your app is compromised you are hosed (which is why the guide focuses on app security since windows server security is pretty easy to set up). To put this in perspective, every large data breach in the past 5 years could have been prevented by simply implementing domain and server isolation
    – Jim B
    Dec 30, 2009 at 20:59
1

You are missing an important point. Attacks are not only done from outside. So if someone compromises the firewall, they can invoke the WCF service. Second scenario would be that someone mimics to be the webserver, that will fool the firewall and that someone would invoke the WCF service. Since you said the data is critical, the risk is bigger than the cost for the authentication.

Improve this answer
2
  • How would someone "mimic to be the firewall"? Are you simply referring to ip address spoofing or something else?
    – Nathan
    Feb 9, 2010 at 17:19
  • I was not talking about that someone mimics to be the firewall. But, that someone with insider knowledge and access to your internal network is attacking the system. This way, you avoid the firewall between the outside world and the webserver. IP spoofing might be one of the scenarios. THe whole attempt with my answer was to shift the focus from 'all' attacks come from the outside to attacks can come from outside and inside (e.g. emploiyees and contractors).
    – Peter Schuetze
    Feb 10, 2010 at 13:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .