RE: Web Service Implementation Security Question

From: Steven Cheng[MSFT] (stcheng_at_online.microsoft.com)
Date: 08/03/05

  • Next message: JimM: "RE: Web Service Implementation Security Question" 
    Date: Wed, 03 Aug 2005 12:24:24 GMT

    Hi Jim,

    Welcome to MSDN newsgroup.
    As for the security problems regarding on using TypedDAtaset in asp.net
    webservice, based on my experience, those dynamically compiled assemblies
    are the ones used for XmlSerialization. Since we return the typedDataset
    over webservice, the runtime need to serialize it into xml stream which
    will cause some temp classses( help to do the serialization work) being
    generated. However, what makes me feel a bit strange is that you mentioned
    the assemblies are generated under the %win%\temp dir? As far as I know,
    the asp.net runtime's temp assemblies should be reside in the

    %win%\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\%app
    specific dir%

    Also, one thing I'm thinking about is whether the problem is related to the
    specific application pool identity you specific? What's the behavior when
    you switch back to use the default Network Service identity? Also, on
    IIS6/win2k3 box, when we want to clone a asp.net process identity (like the
    Networkservice), we can just simply add the account into the local IIS_WPG
    group which is just for the IIS worker process identities.

    Anyway, IMO, I don't think acessing the ASP.NET specific temp dir will
    cause vulnerability, generally vulnerability only occurs when the IIS
    server or asp.net app has been compromised or hacked which is rarely in
    net managed world

    Thanks,

    Steven Cheng
    Microsoft Online Support

    Get Secure! www.microsoft.com/security
    (This posting is provided "AS IS", with no warranties, and confers no
    rights.)

    --------------------
    | Thread-Topic: Web Service Implementation Security Question
    | thread-index: AcWXrU2eKoxWNAjNR12bWC3v7J+OUg==
    | X-WBNR-Posting-Host: 155.148.26.103
    | From: "=?Utf-8?B?SmltTQ==?=" <JimM@noemail.nospam>
    | Subject: Web Service Implementation Security Question
    | Date: Tue, 2 Aug 2005 14:58:23 -0700
    | Lines: 90
    | Message-ID: <D8AFC9AE-2BD3-4FD7-89A4-0A25CCEC3F88@microsoft.com>
    | MIME-Version: 1.0
    | Content-Type: text/plain;
    | charset="Utf-8"
    | Content-Transfer-Encoding: 8bit
    | X-Newsreader: Microsoft CDO for Windows 2000
    | Content-Class: urn:content-classes:message
    | Importance: normal
    | Priority: normal
    | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
    | Newsgroups: microsoft.public.inetserver.iis.security
    | NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
    | Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
    | Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.inetserver.iis.security:8114
    | X-Tomcat-NG: microsoft.public.inetserver.iis.security
    |
    | THIS IS A RE-POST OF A PREVIOUS QUESTION, SO I GET MY MSDN RESPONSE.
    |
    | I don’t know if this is the correct newsgroup for this question, but it
    is
    | about security and vulnerabilities.
    |
    | I need to get the following questions answered in response to some
    security
    | issues raised about Web Services by my system administrator. I know this
    is
    | long but bear with me.
    |
    | First some basic background:
    |
    | 1. The Web Service was implemented using Visual Studio 2003 and it uses
    | strongly typed Datasets. Each Dataset contains multiple tables with one
    or
    | more rows and relationship defined. The Dataset is the method’s return
    | value.
    |
    | 2. The Web Service is installed on a Windows 2003 Server.
    |
    | 3. The Web Service is run within its own Application Pool with a unique
    | Identity.
    |
    | 4. When a service method returning a Dataset is called, the schema (XSD)
    | file for the Dataset(s) is “compiled?or “re-compiled?(don’t
    know if
    | compiled is the correct term but I’ll use if for this topic) and the
    | %windir%\Temp directory is used.
    |
    | 5. The service uses Windows authentications and the code contains check
    for
    | authorizing methods based on User Groups.
    |
    | My first questions are:
    |
    | 1. Why is the Dataset’s XSD schema file “compiled? Once the Web
    Service is
    | generated by VS 2003 the Class for the Dataset exists as a C# (CS) file.
    |
    | 2. Is the XSD file “compiled?for each initial invocation of the Web
    Service?
    |
    | 3. Is there away, other than using untyped Datasets, from having the XSD
    | file compiled?
    |
    | Now the server where this Web Service is running is very tightly locked
    | down. The %windir%\Temp directory security is set such that the
    compiling of
    | the Dataset schema files fails with a
    “System.InvalidOperationException:
    | Unable to generate a temporary class (result=1)? The system admin will
    not
    | enable the %windir%\Temp directory so the schema can compile. He states,
    that
    | write access to the Temp directory is a vulnerability with Web Services,
    but
    | it is not a problem with Web Pages. I do not see a difference between
    Web
    | Page and Services.
    |
    | Now my solution is to:
    |
    | 1. Create the Web Service’s Application Pool Identity by copying the
    NETWORK
    | SERVICE built-in account in the User and Group admin utility.
    |
    | 2. Have the process that “compiles?the schema files use another
    directory
    | path. To do this the web.config file is modified on the
    ?compilation>?
    | element by adding a “tempDirectory?attribute, which points to a non
    Virtual
    | Directory file pate. This prevents access from the Web Service URL.
    |
    | 3. Set the security on the new path such that only the Identity for the
    | Application Pool can access it. The setting should mirror those of the
    | NETWORK SERVICE‘s setting for the %windir%\Temp path.
    |
    | I have this configuration working on my test environment of two Windows
    2003
    | servers, so I know it runs.
    |
    | My last questions are:
    |
    | Are there any vulnerability with a Web Service and the temporary
    | directories? I do not see any. The Web Service is authenticating the
    user
    | via Windows authentication so the user must be on our Intranet. So
    unless
    | the domain is compromised Internet access is blocked. The service is
    running
    | with its service account, which has minimal permissions and privileges.
    So
    | it the service account is compromised access is limited on resource
    access.
    | Bad information in the SOAP message is prevented using strong types. If
    a
    | message is incorrect (buffer overrun) that is caught via the strong types
    | causing exceptions.
    |
    | If there is a problem what is it? And is there a solution?
    |
    | The only acceptable solution I have been given by the administrators
    | in-house is not to use strongly typed Datasets, thus avoiding the schema
    file
    | compile. This I find unacceptable, all the information I have read leads
    me
    | to choose strongly typed Datasets! Plus uptyped Datasets are a
    collection of
    | System.Objects, which accept anything as data.
    |
    | Jim
    |
    |
    | --
    | Jim
    |

  • Next message: JimM: "RE: Web Service Implementation Security Question"

    Relevant Pages

    • Re: WSE 3.0, usernameOverTransportSecurity, custom Token Manager w/ securityTokenManager,
      ... I've added the web service call directly to my Data binding method ... expected but not present in the security header of the incoming ... the username token to the message. ... protected override string AuthenticateToken(UsernameToken token) ...
      (microsoft.public.dotnet.framework.webservices.enhancements)
    • Re: Cannot read a Security Log from ASP.net web service
      ... it's a very bad idea to grant that permission to the ASPNET ... Here's the error I get after adding the ASPNET account to the Admin group: ... Cannot open log Security on machine .. ... > a web form that calls a web service. ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • RE: Recommendations for securing a local webservice.
      ... You seem to be trying to secure a web service interface to only those ... protocol that was intended to be caller agnostic to implement a caller ... Install a special certificate as part of the ... Combine #2 with token based security. ...
      (microsoft.public.dotnet.framework.aspnet.webservices)
    • RE: WSE 2.0, smart client, Username authentication, no x.509
      ... web services WSE 3.0 hosts them without a web server for you (read the WSE ... To perform authentication, because your database does not contain user ... the implementation William Stacey has uses Security ... > server where my web service is ...
      (microsoft.public.dotnet.framework.webservices.enhancements)
    • Web Service Implementation Security Question
      ... The Web Service is installed on a Windows 2003 Server. ... Why is the Dataset’s XSD schema file “compiled”? ... enable the %windir%\Temp directory so the schema can compile. ... Have the process that “compiles” the schema files use another directory ...
      (microsoft.public.inetserver.iis.security)