"Invalid JSON primitive errors: alihack" originating from the ASP.NET MVC site

Question

We began to receive several such errors daily, appearing in the event log:

Invalid JSON primitive: alihack. in System.Web.Script.Serialization.JavaScriptObjectDeserializer.DeserializePrimitiveObject () in System.Web.Script.Serialization.JavaScriptObjectDeserializer.DeserializeInternal (Int32 depth) with System.Web.Script.Serialization.JavaScriptObjectDeserializer.BasicDeserialerial String (input serializer) in System.Web.Script.Serialization.JavaScriptSerializer.Deserialize (JavaScriptSerializer serializer, String input, Type type, Int32 depthLimit) with System.Web.Mvc.JsonValueProviderFactory.GetDeserializedObject (ControllerContext controlContext) in System.Web.Mvc.iderVsonJsonalison. GetValueProvider (ControllerContext controlContext) in System.Web.Mvc.ValueProviderFactoryCollection.GetValueProvider (ControllerContext controlContext) in System.Web.Mvc.ControllerBase.get_ValueProvider (Parameter) ParameterDescriptionContextorControlTechnetcontextorcontrolmeterctionControlmeter . Web.Mvc.ControllerActionInvoker.GetParameterValues ​​(ControllerContext controllerContext, ActionDescriptor actionDescriptor) in System.Web.Mvc.Async.AsyncControllerActionInvoker <. > C__DisplayClass21.b__19 (AsyncCallback asyncCallback, Object asyncState) when System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncResult 1.CallBeginDelegate(AsyncCallback callback, Object callbackState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncResultBase . callback, object state, Int32 timeout) at System.Web.Mvc.Async.AsyncControllerActionInvoker.BeginInvokeAction (ControllerContext controllerContext, String actionName, AsyncCallback callback, State object) in System.Web.Mvc.Controller.b__1c (AsyncCallback , Object asyncState, ExecuteCoreState innerState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid 1.CallBeginDelegate(AsyncCallback callback, Object callbackState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncResultBase 1.Brack.bin Object Timeout In t32) with System.Web.Mvc.Controller.BeginExecuteCore (AsyncCallback callback, Object state) with System.Web.Mvc.Controller.b__14 (AsyncCallback asyncCallback, Object callbackState, controller controller) in System.Web.Mvc.Async.AsyncResultWrapper .WrappedAsyncVoid 1.CallBeginDelegate(AsyncCallback callback, Object callbackState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncResultBase 1.Begin (AsyncCallback callback, object state, Int32 timeout). (RequestContext requestContext, AsyncCallback callback, object state) in System.Web.Mvc.Controller.System.Web.Mvc.Async.IAsyncController.BeginExecute (RequestContext requestContext, AsyncCallback callback, object state) in System.Web.Mvc.MvcHler .b__4 (AsyncCallback asyncCallback, Object asyncState, Pro cessRequestState innerState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid 1.CallBeginDelegate(AsyncCallback callback, Object callbackState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncResultBase state Int32 out) when System.Web.Mvc.MvcHandler.BeginProcessRequest (HttpContextBase httpContext, AsyncCallback callback, object state) in System.Web.Mvc.MvcHandler.BeginProcessRequest (HttpContext httpContext, SystemWeb object callback). Mvc.MvcHandler.System.Web.IHttpAsyncHandler.BeginProcessRequest (HttpContext context, AsyncCallback cb, Object extraData) with Orchard.Mvc.Routes.ShellRoute.HttpAsyncHandler.BeginProcessRequest (HttpCpectback CallHandlerExecutionStep.System.Web. HttpApplication.IExecutionStep.Execute () on System.Web.HttpApplication.ExecuteStep (step IExecutionStep, Logical & completedSynchronously)

Requests are sent to http://example.com/ali.txt . There should be something else in the request payload since simply opening this URL correctly leads to 404.

What to worry about? Can I prevent the prevention of such an error and instead return a Bad Request? Why is this de-serialization happening first?

Answer 1

This problem is a duplicate (JSON :: ParserError) "{N}: unexpected token in 'alihack <% eval request (\" alihack.com \ ")%> but for a different server (IIS).

If your site does not use PUT requests, you can simply refuse all those using <requestFiltering /> .

 <configuration> <system.webServer> <security> <requestFiltering> <verbs applyToWebDAV="false"> <add verb="PUT" allowed="false" /> </verbs> </requestFiltering> </security> </system.webServer> </configuration> 

Otherwise, a more elegant solution can be archived using the URL rewrite module (can be installed from the web platform installer ):

 <configuration> <system.webServer> <rewrite> <rules> <rule name="Abort requests to ali.txt - alihack" patternSyntax="Wildcard" stopProcessing="true"> <match url="ali.txt" /> <conditions /> <action type="AbortRequest" /> </rule> </rules> </rewrite> </system.webServer> </configuration>