% 5c vulnerabilities in ASP/ASP. NET

% 5c class vulnerabilities are not repeated in ASP. Let's take a look at its problems in Asp.net.

Microsoft ASP. NET Vulnerability (updated Oct. 7th)

Microsoft announced a possible vulnerability in ASP. net (http://www.microsoft.com/security/incident/aspnet.mspx ). there are not much details so far, but it refers to the "canonicalization" functionality and suggest to implement then hardening measures outlined in kb887459 (http://support.microsoft.com /? Kbid = 887459 ).

It appears that a maid request may confuse ASP. NET and allow access to otherwise protected directories.

If a web server has es a request for a particle URL (e.g. _ http: // server/somedirectory/filename), The 'somedirectory/filename' part has to be mapped to a particle file located on the server. this translation has been the source of contents "directory traversal" bugs. the IIS Unicode exploit is probably the most famous one.

After our original posting of this diary, a few users pointed to the following articles which provide more details then provided by Microsoft's Advisory:
(Thanks to chaouki & Daniel)

Http://www.heise.de/security/news/meldung/51730 (German)
Http://www.derkeiler.com/Mailing-Lists/NT-Bugtraq/2004-09/0068.html
A http://blogs.devleap.com/rob/archive/2004/10/02/1803.aspx (Italian)
Http://www.k-otik.com/news/10052004.ASPNETFlaw.php (French)

It appears that by switching a '/'character in the URL with'/'or' % 5c ', the canonicalization routine will be confused. So if the URL:
Http://www.example.com/secure/file.apx
Is password protected, using the either of the following URLs will bypass the restriction:
Http://www.example.com/secure/file.apx
Http://www.example.com/secure%5Cfile.apx

In addition to the slash/back-slash confusion, one reader reports that inserting a space will bypass the URL restriction as well:
Http://www.example.com/%20/secure/file.apx
(Had no chance to validate this method so far)

Break through level 2 Directory
.. % 5c