A vulnerability exists in Microsoft Information Server (IIS) in which a crafted HTTP GET request may return the contents of a file on the affected server. A possible target of such a request might be a script that should only be executable (not readable) by unauthenticated remote users. The contents of such a file might contain sensitive information such as user credentials for access to a back-end database.
IIS contains a technology called ISAPI (Internet Services Application Programming Interface) which is designed to allow programmers to write custom applications which run on IIS. One ISAPI extension uses .HTR scripts to provide a password management interface via IIS. The .HTR ISAPI extension is implemented in the file ISM.DLL. When IIS receives a request for a file ending in .HTR it performs some pre-processing of the request then passes it off to ISM.DLL. If a malicious user crafts an HTTP request for an existing non-.HTR file and appends "%3F+.HTR" to the request then the requested file will be processed as if it were an .HTR file. Note that "%3F" is a unicode representation of the character "?". If the requested file is not an .HTR file, then the contents of the file will be returned to the requestor, with the exception of text enclosed in script delimiters "<% %>".
The contents of files may be disclosed to unauthenticated remote users. Target files may be CGI scripts that contain sensitive configuration information such as database access credentials. This specific vulnerability does not allow an attacker to access files located outside the root directory of the web server.
Disable .HTR script mapping if not needed, as described in Microsoft Security Bulletin MS01-004:
The CERT Coordination Center thanks Georgi Guninski and Microsoft Product Security for information used in this document.
This document was written by Art Manion.
|Date First Published:||2001-06-15|
|Date Last Updated:||2001-08-07 13:09 UTC|