I have an ASP.Net MVC 4 web application that is hosted on a Windows 2008 server. The application is secured by a custom ASP.Net membership provider. Only users who are granted permission by the admin have access. The application contains sensitive medical data of individuals.
Recently, I discovered that 60 out of 320 registered users are sending suspect requests to my website. These requests get a HTTP status 404 response, as they do not exist on my site and are inadequate. As an example, this is the subset of URLs that contain 'admin':
/_vti_bin/_vti_adm/admin.dll /admin.php /admin/597ea5fc-0805-4b3c-8ab8-3d5320d8683c /admin/chgpwd.php /admin/default.asp /AdminHTML/parse_xml.cgi /admin-serv/authenticate /admin-serv/config/admpw /advwebadmin/adminsettings/browsewebalizerexe.asp /advwebadmin/SQLServ/sqlbrowse.asp /iisprotect/admin/GlobalAdmin.asp /mailman/admin/mailman /phpmyadmin/sql.php /scripts/admin.cgi /shop/admin.php /shopscript/admin.php /SiteServer/admin/ /store/admin.php
Little harm is expected from a request like /store/admin.php, as no .php files are present on the server. It still bothers me, because my users are logged in when the requests arrive. That is, sessions and authentication cookies are sent with the requests. So, if a valid request were sent, the server could disclose sensitive information in the response, as the server trusts the requests to be genuine. I use an anti-forgery token to prevent cross-site request forgery, but this will prevent malicious get requests. These are almost as problematic, due to the sensitive data on the site. Also, if the suspect requests are indeed originating form the user's browser, there is no 'cross-site'.
So far, I have been able to confirm that the authenticated requests arrive when the user is actually using the application. That is, the suspect requests arrive among valid requests and my log also shows the users have logged-in. I am now trying to log complete requests, including origin IP-address, HTTP headers and cookies. Not trivial, as my application is behind a reverse proxy server.
In the mean-time I am wondering what could be the origin of these requests, taking into consideration that so many of my users are involved. Could it be:
- Much present malware in the browsers of the users?
- Other malware on the clients?
- Man-in-the-middle attacks?
- Malware on the web server?
Also, the web application is regularly scanned by a McAfee Penetration test tool. This tool does not log in. I have found out that all URLs in suspicious requests, made from user sessions, are also done by McAfee (205 different URLs, so far). McAfee itself, however, uses many others, as well (3300+). This makes me wonder if the requests from users could get mixed up somewhere in the network, due to caching or whatever, so that I am actually looking at a non-issue. Of course, I have a far bigger issue if requests are mixed up. On the other hand, the requests are time-correlated with the user sessions, not with the running intervals of the penetration tests and maybe the URLs are just the vulnerabilities malware are looking for.