CRV2 FrameworkSpecIssuesASPTop10 - Revision history

Johanna Curiel at 07:43, 24 July 2013

2013-07-24T07:43:56Z

2013-07-24T07:40:54Z

2013-07-24T07:40:32Z

2013-07-24T07:35:58Z

2013-07-24T07:34:05Z

2013-07-24T07:30:34Z

2013-07-24T07:28:52Z

2013-07-24T07:26:30Z

2013-07-24T07:21:54Z

2013-07-24T07:18:03Z

@@ Line 46: / Line 46: @@
 | '''A5-Security Misconfiguration''' ||Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, framework, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc. ||
 '''IIS configurations:'''
-*Proper authorization and authentication configuration in web.config
+*Proper authorization and authentication configuration in web.config,Machine config , ApplicationHost.config
 '''SQL (server) code:'''
@@ Line 56: / Line 55: @@
 *Implementation of Obfuscation for assemblies
 *Prevention of Round tripping
 *Always check the MD5 hashes of the .NET Framework assemblies to prevent the possibility of rootkits in the framework. . Checking the MD5 hashes will prevent using altered assemblies on a server or client machine. See File:Presentation - .NET Framework Rootkits - Backdoors Inside Your Framework.ppt

@@ Line 26: / Line 26: @@
 *Form element Validation: ASP.NET validates the cookie, but does not encrypt it. This can uncover information to an attacker.
 *Look for failure to limit database access and inadequate separation of privileges
-*Connectionstrings without setting a password sucvh as
+*Connectionstrings without setting a password such as
   Server=.\SQLExpress;AttachDbFilename=|DataDirectory|database.mdf;Trusted_Connection=Yes;

@@ Line 26: / Line 26: @@
 *Form element Validation: ASP.NET validates the cookie, but does not encrypt it. This can uncover information to an attacker.
 *Look for failure to limit database access and inadequate separation of privileges
 |-

@@ Line 25: / Line 25: @@
 *Form element Encryption property: ASP.NET encrypts the cookie, but is not validate it. This may leave your application open to attack.
 *Form element Validation: ASP.NET validates the cookie, but does not encrypt it. This can uncover information to an attacker.
 |-

@@ Line 72: / Line 72: @@
 *Use of Assembly Attributes
 *Proper configuration of folder/ CRUD access permissions of web content files
 |-

@@ Line 77: / Line 77: @@
   ||
 *Use of Anti-forgery Helpers, Html.AntiForgeryToken() and the filter [ValidateAntiForgeryToken]
 |-

@@ Line 23: / Line 23: @@
 *Proper implementation of <Authentication> en <Authorization> property in web.config files
 *Never use "none" for the <protection> attribute within <Forms> property in web.config file
 |-

@@ Line 22: / Line 22: @@
 *Clear connectionstrings without encryption
 *Proper implementation of <Authentication> en <Authorization> property in web.config files
 |-

@@ Line 21: / Line 21: @@
 *Clear-text credentials in web.config files
 *Clear connectionstrings without encryption
-*Proper implementation of <Authentication> property in config files
+*Proper implementation of <Authentication> en <Authorization> property in web.config files
 |-