Add a lock to your FileSystemObject object-asp the vulnerability set

Filesystemobject| object now provides support for the ASP free space more and more, for the ASP enthusiasts is undoubtedly a good momentum, but many provide free ASP space sites are not on the FileSystemObject this to


as a result of any restrictions, this also leads to security issues. For example, this year's April Fool's Day "Dongguan window" all the home page has been attacked by hackers, in fact, to do this thing is very simple, is the use of FileSystemObject objects,


the specific procedure is no longer discussed. And another well-known site to provide ASP space "Network" also exists in this security loophole, is vulnerable to attack. Not only are the sites that provide free space exist this


security vulnerabilities, many domestic virtual host providers also have this security risk. This brings a lot of harm to business users.


So how can we restrict users from using FileSystemObject objects? An extreme approach is to completely reverse the registration of the component that provides the FileSystemObject object, namely the Scrrun.dll. The specific side

The
method is as follows:


under MS-DOS status type:


regsvr32/u C:\Windows\system\scrrun.dll


(Note: Change to be your local actual path in the actual operation)


However, it is obvious that if you do this, anyone, including the site system administrator, will not be able to use the FileSystemObject object, which is not the result that site managers want, after all


we use this object to achieve a convenient online platform management, if not even the system administrator can not use, it is not worth it, but do not prohibit this dangerous object will bring security vulnerabilities to their own site. So

Does
have a way to both worlds? Yes! The specific methods are as follows:


we can prevent others from illegally using FileSystemObject objects, but we can still use this object ourselves.

The
method is as follows:


Find the Registry


hkey_classes_root\scripting.filesystemobject Key Value


change it to the string you want (right---> "rename"), such as changing to


Hkey_classes_root\scripting.filesystemobject2


this way, the ASP has to refer to this object:


Set fso = CreateObject ("Scripting.filesystemobject2")


and cannot be used:


Set fso = CreateObject ("Scripting.FileSystemObject")


If you use the usual method to invoke the FileSystemObject object, you will not be able to use it.


Oh, as long as you do not tell others this changed object name, other people are unable to use the FileSystemObject object. In this way, as a site manager, we eliminate the illegal use of FileSystemObject by others


objects, and we can still use this object to facilitate the implementation of Web site online management and so on!


(The above methods are tested in WIN98+PWS and WINNT4+IIS4 environments)