Application Security Scan performed on our application using IBM's AppScan standard tool and below issue has been reported. I am a .net developer, and unaware of these security terms. Could somebody please explain me how my application is vulnerable.

It is MVC Application and the framework is .Net.

Issue reported 'Direct Access to Administration Pages ,The web server or application server are configured in an insecure way.'

Reason: AppScan requested a file which is probably not a legitimate part of the application. The response status was 200 OK. This indicates that the test succeeded in retrieving the content of the requested file.

  • 1
    Try the request yourself and check if you can actually get to a sensitive page. Often issues like this are false positives that happen when a page is not found or can't be accessed but the error message is send with a "OK" status code.
    – floworbit
    Sep 19, 2017 at 10:04

2 Answers 2


Administrative interfaces should not be exposed to the internet where possible as whilst it is not necessary exploitable, it still gives attackers an insight into the software you are using and provides an avenue of attack for them i.e. guessing usernames and passwords in an attempt to gain access.

By the sounds of it, the scan picked up that a page (believed to be an admin interface) could successfully be visited. The best way to check whether or not this is a false positive is by visiting the link yourself, preferably from a machine/device that is not part of your work network to determine whether its available externally. If you find it is accessible, then normally it is recommended to filter access to that page either by making it accessible only from internal addresses or requiring authentication prior to accessing the login with unsuccessful attempts returning a 403/401 response.


The admin page should be protected and only authorized users should be able to access it. It means that your application should return either

  • HTTP 401 Unauthorized (when authentication is missing or incorrect), or
  • HTTP 403 Forbidden (when user is authenticated, but lacks authority to access this page)

The current response code HTTP 200 indicates that it is possible to successfully access restricted part of the web site (from the context, I guess without being authenticated or being authenticated but still lacking permissions to access this part of the site)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .