microsoft / CSS-Exchange

Exchange Server support tools and scripts
MIT License
1.21k stars 333 forks source link

[Issue] - Health Checker Get-URLRewirteRule doesn't honor Remove #2003

Open dpaulson45 opened 5 months ago

dpaulson45 commented 5 months ago

Describe the issue HealthChecker reported an issue with the URL Rewrite Rule calling out a problem rule that would cause a 500, but they are not seeing the rule within IIS Manager.

Expected behavior Make it easier to identify what the problem is vs making it hidden.

Script Output

        RewriteRuleName                 Pattern                                 MatchProperty  ActionType      
        ---------------                 -------                                 -------------  ----------      
        EEMS M1.1 PowerShell - inbound  (?=.*autodiscover)(?=.*powershell)      url - .*       AbortRequest    
        PowerShell - inbound            .*autodiscover\.json.*Powershell.*      url - .*       AbortRequest    
        ZeroDay_Mitigation              .*autodiscover\.json.*\@.*Powershell.*  url - *        CustomResponse  

    Misconfigured URL Rewrite Rule - URL Match Problem Rules: ZeroDay_Mitigation
        URL Match is set only a wild card which will result in a HTTP 500.
        If the rule is required, the URL match should be '.*' to avoid issues.

Inside of the applicationHost.config file under the Default Web Site\Autodiscover location we have the following URL Rewrite Rule

            <rewrite>
                <rules>
                    <rule name="ZeroDay_Mitigation" stopProcessing="false">
                        <match url="*" />
                        <conditions>
                            <add input="{REQUEST_URI}" pattern=".*autodiscover\.json.*\@.*Powershell.*" />
                        </conditions>
                        <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
                    </rule>
                </rules>
            </rewrite>

Then inside the web.config for autodiscover, we have the following defined which doesn't enable the rule.

                                     <rewrite>
                                         <rules>
                                             <remove name="PowerShell - inbound" />
                                             <remove name="EEMS M1.1 PowerShell - inbound" />
                                             <remove name="ZeroDay_Mitigation" />
                                             <rule name="PowerShell - inbound" stopProcessing="true">
                                                 <match url=".*" />
                                                 <conditions>
                                                     <add input="{UrlDecode:{REQUEST_URI}}" pattern=".*autodiscover\.json.*Powershell.*" />
                                                 </conditions>
                                                 <action type="AbortRequest" />
                                             </rule>
                                         </rules>
                                     </rewrite>

Additional context After discussion, we shouldn't include the rule since it isn't enabled, which should be similar as a </clear>.