HTTP: IIS ASP.Net Directory Authentication Bypass

This signature detects backslash (\) characters in the URL portion of an HTTP request. Attackers can use a backslash as a directory separator instead of the normal forward slash (/) to bypass the Microsoft IIS ASP.Net authentication capabilities and access protected resources. Note: A poorly configured Web server can also display a backslash in a non-malicious URL request.

Extended Description

Microsoft ASP.NET is reported prone to a remote information-disclosure vulnerability because the application fails to properly secure documents when handling malformed URI requests. An attacker may leverage this issue to bypass authentication required to access files in secured directories.

Affected Products

Microsoft .net_framework

References

BugTraq: 11342

CVE: CVE-2004-0847

URL: http://support.microsoft.com/?kbid=887459 http://www.microsoft.com/technet/security/bulletin/ms05-004.mspx http://www.us-cert.gov/cas/techalerts/TA05-039A.html

Short Name

HTTP:IIS:ASP-DOT-NET-BACKSLASH

Severity

Minor

Recommended

False

Recommended Action

None

HTTP: IIS ASP.Net Directory Authentication Bypass

Extended Description

Affected Products

References

Found a potential security threat?