Description

Detects dangerous impersonation configuration in ASP.NET web.config files where Windows authentication is enabled along with impersonation. This configuration allows the application to execute actions with the credentials of the authenticated user, which could lead to privilege escalation if not properly controlled.

Detection Strategy

• Scans web.config files for ASP.NET configuration

• Checks if Windows authentication mode is enabled within system.web section

• Verifies if identity impersonation is set to true

• Reports a vulnerability when both conditions are found in the same system.web section

Vulnerable code example

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.web>
        <!-- Vulnerable: Enabling Windows auth with impersonation allows potential privilege escalation -->
        <authentication mode="Windows"/>
        <identity impersonate="true"/> 
    </system.web>
</configuration>

✅ Secure code example

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.web>
        <!-- Safe: Windows auth without impersonation prevents privilege escalation -->
        <authentication mode="Windows"/>
        <identity impersonate="false"/>
    </system.web>
</configuration>