Several weeks ago one of my legacy web
applications written in Classic ASP underwent a security
scan/evaluation. The report indicated that the application contains server error response vulnerability.
I had already configured the IIS to redirect the HTTP 500 - Internal
Server Error to the custom error page. The users are seeing the custom
error page instead of error details. So, what are we missing here? We
start to debug the application by using Fiddler and found out that the
application was returning status code 500 instead of 200.
Figure 1:
![Status code 500]()
The report indicates that this exposure will allow the attacker to
distinguish between valid and invalid request attempts. After spending
some time researching for the solution, I found this article "How Web site administrators can troubleshoot an "HTTP 500 - Internal Server Error" error message on IIS 4.0 or on IIS 5.0"". The solution is to add the following line on top of the custom error page.
Listing 1:
Response.Clear()
Response.Status ="200 OK"
|
The first line will erases any buffered HTML
output and ensure that the page is displaying a clean error page. The
second line specifies the value of the status line returned by the
server. Load the page that throw HTTP 500 - Internal Server Error
again, and we should see the result similar to figure 2.
Figure 2:
![Status code 500]()
If your website is being audited and come across
this sort of situation, this could be one of the solutions. Hope
someone will find this information useful.
References:
http://support.microsoft.com/kb/311766