Improving Web Application Security: Threats and - CGISecurity

Chapter 12: Building Secure Web Services 323Disclosure of Configuration DataThere are two main ways in which a Web service can disclose configuration data.First, the Web service may support the dynamic generation of Web ServiceDescription Language (WSDL) or it may provide WSDL information indownloadable files that are available on the Web server. This may not be desirabledepending on your scenario.Note WSDL describes the characteristics of a Web service, for example, its method signatures andsupported protocols.Second, with inadequate exception handling the Web service may disclose sensitiveinternal implementation details useful to an attacker.VulnerabilitiesVulnerabilities that can lead to the disclosure of configuration data include:●●●Unrestricted WSDL files available for download from the Web serverA restricted Web service supports the dynamic generation of WSDL and allowsunauthorized consumers to obtain Web service characteristicsWeak exception handlingCountermeasuresYou can use the following countermeasures to prevent the unwanted disclosure ofconfiguration data:● Authorize access to WSDL files using NTFS permissions.● Remove WSDL files from Web server.● Disable the documentation protocols to prevent the dynamic generation of WSDL.● Capture exceptions and throw a SoapException or SoapHeaderException — thatreturns only minimal and harmless information — back to the client.Message ReplayWeb service messages can potentially travel through multiple intermediate servers.With a message replay attack, an attacker captures and copies a message and replaysit to the Web service impersonating the client. The message may or may not bemodified.