Improving Web Application Security: Threats and - CGISecurity

456 Part IV: Securing Your Network, Host, and Application●●Script source access. Configure Script source access permissions only on foldersthat allow content authoring.Write. Configure Write permissions only on folders that allow content authoring.Grant write access only to content authors.Note Folders that support content authoring should be configured to require authentication andSSL for encryption.Remove or Secure FrontPage Server ExtensionsIf you do not use FrontPage Server Extensions (FPSE), disable it. If you use FPSE,take the following steps to improve security:● Upgrade server extensions. See to the security issues covered in MSDNarticle, “Microsoft FrontPage Server Extensions 2002 for Windows” athttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnservext/html/fpse02win.asp.●Restrict access using FrontPage security. FPSE installs groups that are grantedpermissions to those Web sites for which the server extensions are configured.These groups are used to restrict the access available based on the role of the user.For more information, see the Assistance Center at http://office.microsoft.com/assistance/2002/articles/fp_colmanagesecurity.aspx.Step 12. Script MappingsScript mappings associate a particular file extension, such as .asp, to the ISAPIextension that handles it, such as Asp.dll. IIS is configured to support a range ofextensions including .asp, .shtm, .hdc, and so on. ASP.NET HTTP handlers are arough equivalent of ISAPI extensions. In IIS, file extensions, such as .aspx, are firstmapped in IIS to Aspnet_isapi.dll, which forwards the request to the ASP.NETworker process. The actual HTTP handler that processes the file extension is thendetermined by the mapping in Machine.config or Web.config.The main security issues associated with script mappings are:●●An attacker could exploit a vulnerability found in an extension.This could occur if a vulnerability in an extension remains unpatched. Unusedextensions increase the area of potential attack. For example, if you do not use aparticular extension, you might not pay attention to relevant updates.Server-side resources could be downloaded by the client.This could occur when a file extension is not mapped correctly. Files that shouldnot be directly accessible by the client should either be mapped to the appropriatehandler, based on its extension, or should be removed.