4

So I plan on updating some data via an ASMX web service on a web server via .NET programs running elsewhere. The primary security concern is that this web service needs to spawn a process to handle the data. I'm utilizing the built in windows authentication system and restricting access to a local web server's windows group. I plan on spawning the process via impersonation of a user with only the necessary permissions to accomplish its tasks. The user will only be used to launch this program. Is this an ok design or do I have a glaring issue that I've overlooked?

Additional details:

Impersonation user is hard coded into program. If data is modified in transit, not particularly catastrophic, program runs nightly without any personal or secure data being sent. Would be an issue if data was always modified, but that seems to imply a permanent middle man attack.

|improve this question
  • Who is the web service exposed to? What type of data goes in and what comes out? When you say it needs to span a process to handle the data are you talking about input, output, or both? What kind of process is it, a windows executable, command-line exe, dll? What kind of attacks are you concerned about? – Mark Burnett Apr 10 '12 at 3:23
3
+25

Check the inputs to the ASMX and for the parameters of the EXE so that you don't create a SQL injection-type of vulnerability. Depending on the app and how the ASMX cleans the parameter calls the EXE you may be opening up the door to a wide system expolit.

Your application may be vulnerable to a DOS attack since impersonation on IIS generally isn't as scalable as other methods (such as Claims based authentication & Trusted Subsystem).

You may also see IIS/Process performance issues that can DOS yourself as the resource workers hang while running the application. You may be better off wrapping your Caller and Win32 app in WCF. Your authentication should flow through the WCF pipeline pretty easily.

How is the ASMX being called? Javascript or a Fat client?

If javascript is being used, make sure that you're protecting yourself from CSRF attacks (Antiforgery token + Cookie over HTTP POST or similar)

|improve this answer
1

Well, from what you are saying I can't immediately think about something that you are doing wrong. I mean, you give the process the least possible privilege to accomplish the task, which is one of the basic rules of security, and you also restrict access to a group. Only make sure that the user you use for the impersonation won't be able to do any other action: since you only want this user to be able to launch the program, you have to make sure that he can't do any other action at the same privilege level.

You might also want to have a look at the following question on Stackoverflow: https://stackoverflow.com/questions/557979/what-should-we-implement-to-authorize-clients-to-use-our-web-service

|improve this answer
0

I would advise that you put the impersonation credentials into the web.config file instead of hard coding it.

In addition, you might want to consider limiting the impersonated user's access. Limitations such as:

  1. accessing the network
  2. having access only to directory and/or database/table containing the required data
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.