Customer is running Qualys Web Application Scan and the WAS Scan Report reported:
150004 Path-Based Vulnerability
I have verified that Directory Browsing is disabled in IIS 10, per How to fix Path Disclosure Vulnerability?. Browsing to https://www.example.com/mywebapp/Content/datepicker/images raises 403 - Forbidden: Access is denied
I can browse directly to the image at https://www.example.com/mywebapp/Content/datepicker/images/ui-icons_444444_256x240.png and visibly see it. F12 tools displays a Status=304 for the file
I tried to adjust access by adding a web.config with the following
<?xml version="1.0" encoding="utf-8"?> <configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0"> <system.web> <authorization> <allow users="*" /> <deny users"?" /> </authorization> </system.web> </configuration>
This locks the image file from view but it also breaks the jQuery UI date picker in the application: F12 console raises an http 500 on the image load and the date picker is missing navigation arrows (and this is when the user is authenticated in ASP.NET and not anon (authenticated user="*", anon user="?") and is using the date picker to select dates).
When I remove the above web.config, the datepicker reverts back to working but I'm back to square one with the red flag from WAS.
Is this something that I can address with an authorization setting in web.config or other ACL without breaking the datepicker? Perhaps I'm chasing a false positive?