Microsoft IIS 6 parsing directory “x.asp” Vulnerability

2011-01-28T00:00:00
ID SECURITYVULNS:DOC:25571
Type securityvulns
Reporter Securityvulns
Modified 2011-01-28T00:00:00

Description

Microsoft IIS 6 parsing directory Vulnerability

Discovered by:

Pouya daneshmand whh_iran[AT]yahoo[DOT]com http://securitylab.ir/blog

Introduction:

Using this vulnerability you can bypass some Security filters, for example a file with “.jpg” or “.rar” extension can be executed as an asp (Active Server Page) file.

Vulnerable:

It just works for asp files and works on Windows 2003 / IIS 6 (As I tested...). The test failed on IIS 5.1 and IIS 7.

Description:

1) Create a Folder with '.asp' extension. 2) Insert your ASP code in a file with any extension (like .jpg,.rar,.txt) in the folder you have created. 3) Open the file with your browser and you will see it's executed as an asp file!

Note:

The Extension of file does not matter at all!

Solution:

There is no patch to fix this security vulnerability yet, the best thing I can say is to DISABLE ASP FILES FROM YOUR "web server extensions"! Or Remove “execute” permission from the upload directories.

PS:

This vulnerability was reported for first time at 2010-06-19 in Persian (http://sebug.net/vulndb/19820/)

Original Advisory:

http://securitylab.ir/blog/dl/Microsoft-IIS6-parsing-directory-Vulnerability.pdf http://securitylab.ir/blog/posts/11/Microsoft-IIS-6-parsing-directory-%E2%80%9Cx.asp%E2%80%9D-Vulnerability/