web

Tenable plugin 121479 is not a product-version bug so much as a *live exposure check*: the scanner was able to request web.config over HTTP and determined the server might return configuration data instead of blocking it. On ASP.NET / IIS stacks, web.config can contain sensitive material such as connectionStrings, appSettings, module settings, and occasionally plaintext or decryptable secrets. Tenable published the plugin on 2019-01-30 and scores it CVSS 5.3 / Medium with vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

In practice, vendor *Medium* is a little generous for fleet-wide prioritization because modern IIS normally treats web.config as a protected hidden segment, so reachable exposure usually implies a local app/server misconfiguration, a reverse-proxy edge case, or a nonstandard file-serving path. The finding still matters on any host where it is confirmed, because the next step can be credential theft and pivoting, but the reachable population is narrow and the direct impact is read-only unless the leaked config contains reusable secrets.

Why this verdict

• Downgrade for default protection: IIS commonly blocks web.config through request filtering / hidden segments, so successful exploitation presumes nondefault server or routing behavior.
• Downgrade for exposure population: this is not a broadly versioned software flaw; it only exists on the subset of apps where the file is actually web-reachable.
• Keep it above IGNORE: if the scanner truly retrieved the file, a no-auth remote attacker may immediately harvest credentials, connection strings, or machine keys and pivot.

Why not higher?

There is no evidence here of active exploitation, no KEV entry, and no broad one-to-many version defect requiring emergency fleet patching. The attacker must hit a host that is both externally reachable and locally misconfigured to serve a file IIS usually protects.

Why not lower?

This is not harmless noise if confirmed. A single exposed web.config can reveal secrets that convert a read-only bug into database access, tenant compromise, or lateral movement, so it deserves remediation rather than documentation-only treatment.

1. Block direct access to web.config — Enforce IIS request filtering / hidden segments and verify upstream proxies, CDN rules, and static-file handlers do not override that behavior. For a LOW verdict there is no SLA-backed mitigation deadline, but this is simple hardening and should be folded into normal backlog hygiene promptly.
2. Review returned content for secrets — If Tenable or manual testing confirms disclosure, inspect the exposed file for connectionStrings, API keys, SMTP creds, machine keys, and internal URLs so you know whether this is merely metadata leakage or a credential incident. For LOW, there is no mitigation SLA, but triage the secret exposure before closing the ticket.
3. Encrypt or externalize sensitive config — Use protected configuration, a secrets vault, or managed identity patterns so that even accidental file disclosure yields little reusable material. This reduces blast radius permanently and should be handled in normal remediation work for LOW findings.
4. Hunt for direct requests in logs — Search IIS, reverse proxy, and WAF logs for GET /web.config and encoded variants to identify whether anyone probed the exposure before remediation. This is low-cost verification and helps decide whether credential rotation is warranted.

Run this from an auditor workstation or directly on the IIS host against the exact application URL that Nessus flagged. Invoke it with powershell -ExecutionPolicy Bypass -File .\check-webconfig.ps1 -Url https://app.example.com/; no admin rights are required because this validates the issue remotely by HTTP response.

param(
    [Parameter(Mandatory=$true)]
    [string]$Url
)

# check-webconfig.ps1
# Purpose: Test whether /web.config is remotely accessible.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

$ErrorActionPreference = 'Stop'

function Write-Result {
    param(
        [string]$State,
        [int]$Code,
        [string]$Detail
    )
    Write-Output ($State + ': ' + $Detail)
    exit $Code
}

try {
    if (-not $Url.StartsWith('http://') -and -not $Url.StartsWith('https://')) {
        Write-Result 'UNKNOWN' 2 'URL must start with http:// or https://'
    }

    $base = $Url.TrimEnd('/')
    $target = $base + '/web.config'

    $response = Invoke-WebRequest -Uri $target -Method GET -MaximumRedirection 5 -UseBasicParsing -TimeoutSec 20 -Headers @{
        'User-Agent' = 'noisgate-webconfig-check/1.0'
        'Accept' = '*/*'
    } -SkipHttpErrorCheck

    $status = [int]$response.StatusCode
    $body = ''
    if ($null -ne $response.Content) { $body = [string]$response.Content }
    $bodySample = $body.Substring(0, [Math]::Min($body.Length, 400))

    $looksLikeConfig = $false
    if ($body -match '<configuration[\s>]' -or
        $body -match '<appSettings>' -or
        $body -match '<connectionStrings>' -or
        $body -match '<system\.web' -or
        $body -match '<system\.webServer') {
        $looksLikeConfig = $true
    }

    if ($status -eq 200 -and $looksLikeConfig) {
        Write-Result 'VULNERABLE' 1 ("HTTP 200 and response looks like web.config from $target")
    }

    if ($status -in 401,403,404,4048,500) {
        Write-Result 'PATCHED' 0 ("Received blocking/non-content status $status from $target")
    }

    if ($status -eq 200 -and -not $looksLikeConfig) {
        Write-Result 'UNKNOWN' 2 ("HTTP 200 but content does not resemble web.config. Sample: $bodySample")
    }

    Write-Result 'UNKNOWN' 2 ("Unexpected HTTP status $status from $target")
}
catch {
    Write-Result 'UNKNOWN' 2 $_.Exception.Message
}

Sources

1. Tenable Plugin 121479
2. Microsoft Learn - Hidden Segments
3. Microsoft Learn - Configure Request Filtering in IIS
4. Microsoft Learn - web.config file for ASP.NET Core on IIS
5. Microsoft Learn - Protecting Connection Strings and Other Configuration Information
6. OWASP WSTG - Review Old Backup and Unreferenced Files for Sensitive Information
7. OWASP WSTG - Test File Extensions Handling for Sensitive Information
8. CISA Known Exploited Vulnerabilities Catalog