IIS 7.5 impersonation threat?

Question

I am using IIS 7.5 and I want to impersonate users for my different applications in an intranet environnement. To do so, I am considering using the asp.net mechanism with the user/password in the web.config (encrypted), but I'm unsure about some possible threats. I'll explain it with a concept (I know my example is useless but it represents my situation so please bear with me)

Let's say that I have 2 directories:

• One empty directory (DirectoryA) that permits access to all users (ntfs permissions) and that contains a web.config that impersonates UserA

• One directory (DirectoryB) containing a web site that I want to restrict access to, which also contains a web.config that impersonates UserA (same user as DirectoryA, not a typo)

To have the impersonation going on DirectoryB, I need to give ntfs permission allowing UserA in DirectoryB.

My question is: is it possible for someone to access DirectoryA (which will impersonate him as UserA) and then somehow access the site on DirectoryB using the impersonated UserA? If it is, how?

Thanks for any insight

Answer 1

IIS 7.5 should keep both sites independant even if the user is the same. I would advise to run the sites in different application pools. :)

But both sites will have access where the user is defined to have access.

So if your web application is not strong enough it might exist the possibility of trying to navigate to the other directory.

"Use ASP.NET impersonation when you want to run your ASP.NET application under a security context different from the default security context for ASP.NET application.

If you enable impersonation for an ASP.NET application, that application can run in one of two different contexts: either as the user authenticated by IIS 7 or as an arbitrary account that you set up. For example, if you were using Anonymous authentication and chose to run the ASP.NET application as the authenticated user, the application would run under an account set up for anonymous users (typically, IUSR). Likewise, if you chose to run the application under an arbitrary account, it would run under whatever security context was set up for that account."

source: http://technet.microsoft.com/pt-pt/library/cc730708(v=ws.10).aspx

Answer 2

I have no "Comment" button, so forgive me if this is not a full answer. Maybe a moderator can convert it to a comment if necessary. But at least I can partially answer your question.

You ask "is it possible for someone to access DirectoryA...". Per default directory browsing is not enabled and you say the directory is empty. This means nothing will be returned and you get a 404 not found error when accessing DirectoryA.

If a user makes a second request (afterwards) and accesses DirectoryB, and userA has access there, you get access. There's no difference if you access DirectoryB or A first.

You are talking about an encrypted user/password in web.config. I'm not sure what you're talking about there, maybe the database connection? In IIS, Basic Settings, Connect As, you define how IIS accesses the files. That can be either "pass through" or a specific user. You talked about a specific user, so that user must have access to the files then. On the other hand you say DirectoryB is restricted, so then you have to use pass through, so that you can limit the permissions on the files.

As a tag you mention ASP.NET. That's another topic. If you're doing authentication via any .NET method, then that's an application question. In any case your question is kinda fuzzy, so it's not clear what to answer to. Maybe you provide some more details or be more clear on what you want to know.