RequestFiltering not working for MS-DOS device name paths

Question

I'm trying to appease a PCI scan failure we recently had done, in which it states:

Microsoft ASP.NET MS-DOS Device Name DoS

Synopsis : A framework used by the remote web server has a denial of service vulnerability. Impact: The web server running on the remote host appears to be using Microsoft ASP.NET, and may be affected by a denial of service vulnerability. Requesting a URL containing an MS-DOS device name can cause the web server to become temporarily unresponsive.

In a nutshell, we visit a URL on our app such as /AUX/.aspx we get a 500 error.

I'm using RequestFiltering to filter these requests out, and return 404's instead, without the server trying to process the request.

An excerpt of my web.config is below:

<system.webServer>
    <security>
        <requestFiltering>
            <denyUrlSequences>
                <add sequence="/AUX/.aspx" />
            </denyUrlSequences>
        </requestFiltering>
    </security>
</system.webServer>

However, this isn't working, it's still returning a 500.

I would expect it to return a 404.

If I add the following catch-all url to the denyUrlSequences then the whole site produces the expected 404.

<add sequence="/" />

It's worth mentioning the application in question is an MVC app running on IIS 7.5 (Windows 2008 R2)

Answer 1

Just had to solve this problem.

My solution was to disable .Net Error Pages and enable IIS Error Pages.

When you move the custom error handling from the higher .Net level to the lower IIS level the HTTP response code changes from 500 to 404.

PCI Test Passed :-)