Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 4737

Running PowerShell scripts inside my asp.net mvc web application. is this an insecure appraoch

$
0
0

I am working on an internal web application which is accessed to only our company AD users. and can only be accessed either inside our network or using VPN. Now inide my application I want to run PowerCLI scripts . so i have installed the PowerCLI application inside my application server. then i wrote the following test action method, and i run the web application inside my visual studio and everything worked well:-

public ActionResult About(string vCenterIp = "****", string vCenterUsername = "****", string vCenterPassword = "****")
        {


var shell = PowerShell.Create();



                string PsCmd = "add-pssnapin VMware.VimAutomation.Core; $vCenterServer = '" + vCenterIp + "';$vCenterAdmin = '" + vCenterUsername + "' ;$vCenterPassword = '" + vCenterPassword + "';" + System.Environment.NewLine;



                PsCmd = PsCmd + "$VIServer = Connect-VIServer -Server $vCenterServer -User $vCenterAdmin -Password $vCenterPassword;" + System.Environment.NewLine;


                PsCmd = PsCmd + "Get-VMHost" + System.Environment.NewLine;



                shell.Commands.AddScript(PsCmd);

                var results = shell.Invoke();




                if (results.Count > 0)

now my question will i be ale to run the above action method when i deploy my web application to an IIS ? as from my reading seems IIS by defualt does not allow to run EXE scripts .. so are there any restrictions or concerns i need to take case of before deploying my application to an IIS since i am running powerCLI scripts inside it ?

second question. is my above approach of running powercli and powershell scripts inside my asp.net mvc web application considered an insecure approach . if the answer is yes then how i can improve it?


Viewing all articles
Browse latest Browse all 4737

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>