IIS Short File/Folder Name Disclosure (iis Short File or Folder Name leakage)

Source: Internet
Author: User
Tags microsoft iis

Comments: IIS Short File/Folder Name Disclosure (iis Short File or Folder Name leakage) I. Background
---------------------
"IIS is a web server application and set
Feature extension modules created by Microsoft for use with Microsoft Windows.
IIS is the third most popular server in the world. "(Wikipedia)
II. Overview
---------------------
Vulnerability Research Team discovered a vulnerability
In Microsoft IIS.
The vulnerability is caused by a tilde character "~ "In a Get request, which cocould allow remote attackers
To diclose File and Folder names.
III. Affected Products
---------------------------
IIS 1.0, Windows NT 3.51
IIS 2.0, Windows NT 4.0
IIS 3.0, Windows NT 4.0 Service Pack 2
IIS 4.0, Windows NT 4.0 Option Pack
IIS 5.0, Windows 2000
IIS 5.1, Windows XP Professional and Windows XP Media Center Edition
IIS 6.0, Windows Server 2003 and Windows XP Professional x64 Edition
IIS 7.0, Windows Server 2008, and Windows Vista
IIS 7.5, Windows 7 (error remotely enabled or no web. config)
IIS 7.5, Windows 2008 (classic pipeline mode)
Note: Does not work when IIS uses. Net Framework 4.
IV. Binary Analysis & Exploits/PoCs
---------------------------------------
Tilde character "~ "Can be used to find short names of files and folders when the website is running on IIS.
The attacker can find important file and folders that they are not normaly visible.
In-depth technical analysis of the vulnerability and a functional exploit
Are available through:
Http://soroush.secproject.com/blog/2012/06/microsoft-iis-tilde-character-vulnerabilityfeature-short-filefolder-name-disclosure/
V. Solution
----------------
There are still workarounds through Vendor and security vendors.
Using a configured WAF may be usefull (discarding web requests including the tilde "~ "Character ).
VII. Reference
----------------------
Http://support.microsoft.com/kb/142982/en-us
Http://soroush.secproject.com/blog/2010/07/iis5-1-directory-authentication-bypass-by-using-i30index_allocation/

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.