Exposed localstart.asp page

Low Web Application Scanning Plugin ID 98088

Synopsis

Exposed localstart.asp page

Description

To restrict access to specific pages on a webserver, developers can implement
various methods of authentication, therefore only allowing access to clients
with valid credentials.
There are several forms of authentication that can be used. The simplest forms of
authentication are known as 'Basic' and 'Basic Realm'.
These methods of authentication have several known weaknesses such as being
susceptible to brute force attacks.

Additionally, when utilising the NTLM mechanism in a windows environment, several
disclosures of information exist, and any brute force attack occurs against the
server's local users, or domain users if the web server is a domain member.

Cyber-criminals will attempt to locate protected pages to gain access to them
and also perform brute force attacks to discover valid credentials.

Scanner discovered the following page requires NTLM based basic authentication
in order to be accessed.

Solution

If the pages being protected are not required for the functionality of the web application they should be removed, otherwise, it is recommended that basic and basic realm authentication are not used to protect against pages requiring authentication.
If NTLM based basic authentication must be used, then default server and domain accounts such as `administrator` and `root` should be disabled, as these will undoubtedly be the first accounts to be targeted in any such attack.
Additionally, the webserver should not be joined to any corporate domain where usernames are readily available (such as from email addresses). If the pages are required, and it is possible to remove the basic authentication, then a stronger and more resilient form-based authentication mechanism should be implemented to protect the affected pages.

Plugin Details

Severity: Low

ID: 98088

Type: remote

Published: 2017/03/31

Modified: 2017/10/16

Risk Information

Risk Factor: Low

CVSS v2.0

Base Score: 2.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS v3.0

Base Score: 3.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Reference Information