X-AspNet-Version Response Header Scanner

Reference

Plugin Id: 10061 | CWE: 933

Remediation

To remediate the vulnerability “X-AspNet-Version Response Header Scanner,” follow these steps:

Disable the X-AspNet-Version and X-AspNetMvc-Version headers: These headers can be disabled in the web server configuration. For example, in Apache, you can use the following configuration in your .htaccess file:
```
Header always unset X-AspNet-Version
Header always unset X-AspNetMvc-Version
```
In Nginx, you can use the following configuration in your server block:
```
location / {
    proxy_hide_header X-AspNet-Version;
    proxy_hide_header X-AspNetMvc-Version;
}
```
Update the web application framework: Ensure that you are using the latest version of the web application framework, as newer versions may have addressed this vulnerability by not including the version information in the response headers.
Implement a web application firewall (WAF): A WAF can help detect and block requests that exploit this vulnerability. Configure the WAF to block any requests that contain the X-AspNet-Version or X-AspNetMvc-Version headers.

About

The vulnerability “X-AspNet-Version Response Header Scanner” refers to a situation where a web server leaks information by including the “X-AspNet-Version” or “X-AspNetMvc-Version” headers in the HTTP response. These headers reveal the version of the ASP.NET or ASP.NET MVC framework being used by the server.

Attackers can exploit this vulnerability to gather information about the server’s configuration and potentially identify known vulnerabilities in the specific version of the framework. This information can then be used to launch targeted attacks against the server.

Risks

The risks associated with the “X-AspNet-Version Response Header Scanner” vulnerability include:

Information disclosure: By revealing the version of the ASP.NET or ASP.NET MVC framework, attackers can gain insights into the server’s configuration and potentially identify known vulnerabilities in that specific version. This information can be used to launch targeted attacks against the server.
Increased attack surface: By leaking version information, the server provides attackers with additional details that can aid in the planning and execution of attacks. This can increase the overall attack surface and make it easier for attackers to find and exploit vulnerabilities.
Lack of defense-in-depth: The inclusion of version information in the response headers can be seen as a lack of defense-in-depth. It is generally recommended to minimize the amount of information disclosed by the server to reduce the risk of targeted attacks.