Remote Kernel Code Execution Via HTTP Request In IIS On Windows

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by mandeepj on Wednesday April 15, 2015 @02:47PM (#9383194)

Instead of updating every single web.config of your website I think it is better to just update once and for all by updating machine.config. What you say ?

[ Parent | on HN ]

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @02:54PM (#9383251)

Seems like you can't add a system.webServer node on the machine.config, but you could add it to applicationHost.config (source: http://www.iis.net/learn/get-started/planning-your-iis-archi... ) so yes, that would be faster. You have to make sure that none of your web.config files override that setting though!

[ Parent | on HN ]

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by JonBons on Wednesday April 15, 2015 @04:19PM (#9383794)

I believe IIS supports locking attributes (source: http://www.iis.net/learn/get-started/planning-for-security/h...) so you should be able to lock at applicationHost.config and restrict further modifications. (I'm testing this now)

EDIT:

It causes a config error when a lock violation occurs which means the site gets an error 500 so its not an ideal fix.

[ Parent | on HN ]