CWE-520 is a .NET misconfiguration: allowing a .NET application to run at potentially escalated levels of access to the operating system and file system, which can be dangerous. It affects ASP.NET and VB.NET applications and web based systems.
How it happens
MITRE explains that .NET server applications can optionally run with the identity of the user authenticated to the client. The intent is to bypass authentication and access control checks inside the application code. The web server, IIS, does the authentication and passes an authenticated or anonymous token to the application. The application then impersonates the client and relies on NTFS settings on directories and files for access control.
That means the app can execute code and reach resources in the context of whoever authenticated. The risk is that the app code no longer enforces its own limits, and the account it runs under may be far more powerful than the page needs.
In ASP.NET the setting lives in configuration:
<system.web>
<identity impersonate="true" />
</system.web>
What an attacker gains
MITRE lists gaining privileges or assuming an identity. If the application is tricked into acting for a user with broad access, or runs as an account with broad access, any flaw in the app can reach files and resources that the app would otherwise not touch.
How to find it
The record lists no detection methods. Check your configuration files for identity impersonate="true", and for each match ask which identity the app really runs as and what that identity can read and write.
How to fix it
MITRE's mitigation: run the application with limited privilege to the underlying operating and file system.
- Turn impersonation off unless a feature needs it.
- Run the app pool under a dedicated account with only the rights the app uses.
- Keep authorization checks in the application code too, instead of depending only on NTFS permissions.
- Review file and folder rights for the account.
Quick check
What does impersonation let a .NET app do?
Run code and access resources as the authenticated user, relying on NTFS settings for access control.
What is MITRE's mitigation?
Run the application with limited privilege to the operating system and file system.
