I am working on SharePoint Online, and our security team has raised the issue

Observation: The application discloses sensitive information about the application to authenticated and unauthenticated users including the DISCO file and WSDL files

Impact: Any user is able to access the disco file on the web server which discloses the location of WSDL files. WSDL files contain specific and sensitive information about a web service. Using this information an attacker will know precisely how to communicate with the web service and could spot potential weaknesses in the web service. A malicious user could leverage the server information displayed to further compromise the system or network.

when we are entering the URL "https://TENANT.SharePoint.Com/Sites/MySite/_vti_bin/spdisco.aspx" it is exposing the all metadata of asmx sevices url (eg: "https://TENANT.SharePoint.Com/Sites/MySite/_vti_bin/alerts.asmx?wsdl").

Is it possible to hide it for users so user can not able to see this?


Remove the below line from masterpage's <head> section(see screenshot):

<SharePoint:SoapDiscoveryLink runat="server"/>

This will suppress the <link href="/_vti_bin/spsdisco.aspx" rel="alternate" type="text/xml"> reference in the HEAD of your pages.

enter image description here

Check the reference here - SharePoint 2010: Disable / Hide references to SPSDisco.aspx

According to the answer provided here, they have implemented a custom HTTP module. However, such a thing is not possible in SPO, so the only option we have is to hide its references.

But if the user add the url in browser, those references will appear. So we cant do anything about it unfortunately.

  • I have tried the same, and now the spdisco.aspx reference is hidden on browser. but i am able to browse with the url - this is ok, because now user could not see the spdisco.aspx reference. – Abhishek Kumar Seth Dec 23 '16 at 8:09
  • Cool. Please mark it as answer if it helped you :) – Gautam Sheth Dec 23 '16 at 10:21
  • I have done already :) – Abhishek Kumar Seth Dec 23 '16 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.