New ASP.NET Security Vulnerability could allow access to web.config

Re:New ASP.NET Security Vulnerability could allow access to ... by tomjen3 on Sunday September 19, 2010 @03:21AM (#1705776)

For those of you who don't know .net, this is basically where all the site specific configuration files lie - think database passwords, email servers, admin passwords to bootstrap the system, etc.

So this is kind of a big deal.

[ Parent | on HN ]

Re:New ASP.NET Security Vulnerability could allow access to ... by jasonkester on Sunday September 19, 2010 @03:33AM (#1705789)

Indeed, but if you're doing it right, you won't have any passwords there. The things you need to access from a web app tend to allow trusted user access, so all an attacker would be able to get from a properly configured site's web.config would be the name of the database server (or the fact that it's (local)).

[ Parent | on HN ]