2

This url is part of a pci compliance scan and it is flagging the very sparse asp.net error page returned, which on the live site is a 500 status code and the text

Server Error in '/' Application.

Runtime Error

Description: An exception occurred while processing your request. Additionally, another exception occurred while executing the custom error page for the first exception. The request has been terminated.

When running the site in visual studio I however get a 404 and the text

Server Error in '/' Application.

The resource cannot be found.

Description: HTTP 404. The resource you are looking for (or one of its dependencies) could have been removed, had its name changed, or is temporarily unavailable. Please review the following URL and make sure that it is spelled correctly.

Requested URL: /WEB-INF./web.xml

Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.18044

I've tried ignoring that url in routing and mapping it to our 404 route /error/not-found, we have custom errors on with a default redirect to /error/internal. I also tried using a location tag to deny access, blocking it with request filtering, and using a handler with that path to catch the request.

I tried this rewrite, also tried the same rule blocking and redirecting but I still get the same asp.net error page. The image cut off but the rule is ^.*\./.*$ and it does match the url I am trying to filter (I've also tried simply WEB-INF).

rewrite rule

Any idea how I can get this url to show our custom error page?

1

Adding relaxedUrlToFileSystemMapping="true" to the httpRuntime node in the web.config allowed this url to get processed by ASP.Net MVC as expected.

<system.web>
  <httpRuntime relaxedUrlToFileSystemMapping="true" />
</system.web>
0

In IIS, by default detailed error messages are displayed to local clients, which is why you can see these messages via Visual Studio but get the 500 error remotely.

To change, in IIS Manager click on the affected site, click on "Error Pages" in the features view, and in the right-hand pane select "Edit feature settings". You'll then be able to select "custom error pages" and configure things this way.

Edit: There's also a vulnerability with Tomcat:

<servlet-mapping> 
<servlet-name>FileServlet</servlet-name> 
<url-pattern>/</url-pattern> 
</servlet-mapping> 

Find this in your web.xml file and comment it out. This will prevent someone from accessing /WEB-INF./ and accessing your files. Note that /WEB-INF/ should toss an appropriate 404.

  • Pages are configured for 404 and 500 and they display correctly in other error situations but for this url IIS is trumping. – quentin-starin Oct 8 '13 at 21:55
  • Are you using Tomcat? It looks like there's an actual vulnerability. I updated my answer (or will in the next few moments :)) – Nathan C Oct 8 '13 at 21:58
  • no Tomcat installed on that server. It's IIS 8 on Win Server 2012 – quentin-starin Oct 8 '13 at 21:59
  • Then...why do you even have this folder? It's for Java/Servlet stuff. – Nathan C Oct 8 '13 at 22:00
  • I don't have this folder. This site is failing a pci compliance scan because it doesn't like the default IIS error message that it gets back when checking this url for that vulnerability. The dot in the url seems to make it very difficult to catch the request with any sane method I've thought of in IIS/ASP.Net. If I go to any other made-up url in this app it does display our custom 404 page, this one does not however. – quentin-starin Oct 8 '13 at 22:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.