[13185] in bugtraq
Re: More info on MS99-061 (IIS escape character vulnerability)
daemon@ATHENA.MIT.EDU (Joakim Karlmark)
Sun Jan 2 15:41:36 2000
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <00Jan2.125153met.19713@charon.protect-data.se>
Date: Sun, 2 Jan 2000 12:51:50 +0100
Reply-To: Joakim Karlmark <joakim.karlmark@PDKONSULT.COM>
From: Joakim Karlmark <joakim.karlmark@PDKONSULT.COM>
X-To: bugtraq@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <Pine.LNX.4.10.9912292138530.17163-100000@eight.wiretrip.net>
> What does this allow you to bypass? My guess is anything that plays or
> needs the raw filename or request. ISAPI filters and extension handlers
> come to mind. Who, what, where, and how are application specific.
One category of systems that are vulnerable to this are
3rd party authentications modules that do, for example radius
authentication.
One system that I've checked uses a special directory,
lets call it /authRoot where the administrators can store
customized login pages, graphics and so on.
So, by neccessity, it allows unauthenticated access to this
directory.
Unfortunately the ISS bugg allows one to "break out" of this
direcotry by appending %1u%1u (".." in other words).
So, to access default.asp we could would enter the url...
http://server/authRoot/%1u%1u/default.asp
And, ooops, unauthenticate access...
