WSDL File Discovery
Reference
Plugin ID: 90030 WASC: 13 Unknown Passive Information Disclosure
Remediation
- Restrict WSDL access: Remove publicly accessible WSDL files or implement proper access controls.
- Review exposed information: Audit WSDL content to ensure no sensitive operations, parameters, or internal details are exposed.
- Use authentication: Require authentication to access web service documentation and WSDL files.
- Sanitize WSDL content: Remove any internal comments, development endpoints, or sensitive metadata from production WSDL files.
- Monitor access: Log and monitor access to WSDL files for potential reconnaissance activities.
About
WSDL (Web Services Description Language) file discovery occurs when web service definition files are publicly accessible, exposing detailed information about web service operations, parameters, data types, endpoints, and internal service architecture that could assist attackers in reconnaissance.
Risks
Low WSDL file exposure provides attackers with detailed information about web service structure, operations, and parameters, facilitating targeted attacks against specific web service methods and potential abuse of service functionality.