Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Issue] - Health Checker Get-URLRewirteRule doesn't honor Remove #2003

Open
dpaulson45 opened this issue Feb 15, 2024 · 0 comments
Open

[Issue] - Health Checker Get-URLRewirteRule doesn't honor Remove #2003

dpaulson45 opened this issue Feb 15, 2024 · 0 comments

Comments

@dpaulson45
Copy link
Member

Describe the issue
HealthChecker reported an issue with the URL Rewrite Rule calling out a problem rule that would cause a 500, but they are not seeing the rule within IIS Manager.

Expected behavior
Make it easier to identify what the problem is vs making it hidden.

Script Output

        RewriteRuleName                 Pattern                                 MatchProperty  ActionType      
        ---------------                 -------                                 -------------  ----------      
        EEMS M1.1 PowerShell - inbound  (?=.*autodiscover)(?=.*powershell)      url - .*       AbortRequest    
        PowerShell - inbound            .*autodiscover\.json.*Powershell.*      url - .*       AbortRequest    
        ZeroDay_Mitigation              .*autodiscover\.json.*\@.*Powershell.*  url - *        CustomResponse  


	Misconfigured URL Rewrite Rule - URL Match Problem Rules: ZeroDay_Mitigation
		URL Match is set only a wild card which will result in a HTTP 500.
		If the rule is required, the URL match should be '.*' to avoid issues.

Inside of the applicationHost.config file under the Default Web Site\Autodiscover location we have the following URL Rewrite Rule

            <rewrite>
                <rules>
                    <rule name="ZeroDay_Mitigation" stopProcessing="false">
                        <match url="*" />
                        <conditions>
                            <add input="{REQUEST_URI}" pattern=".*autodiscover\.json.*\@.*Powershell.*" />
                        </conditions>
                        <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
                    </rule>
                </rules>
            </rewrite>

Then inside the web.config for autodiscover, we have the following defined which doesn't enable the rule.

                                     <rewrite>
                                         <rules>
                                             <remove name="PowerShell - inbound" />
                                             <remove name="EEMS M1.1 PowerShell - inbound" />
                                             <remove name="ZeroDay_Mitigation" />
                                             <rule name="PowerShell - inbound" stopProcessing="true">
                                                 <match url=".*" />
                                                 <conditions>
                                                     <add input="{UrlDecode:{REQUEST_URI}}" pattern=".*autodiscover\.json.*Powershell.*" />
                                                 </conditions>
                                                 <action type="AbortRequest" />
                                             </rule>
                                         </rules>
                                     </rewrite>

Additional context
After discussion, we shouldn't include the rule since it isn't enabled, which should be similar as a </clear>.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant