Vulnerability Note VU#35085
Microsoft Internet Information Server (IIS) discloses contents of files via crafted request for .htr file
A vulnerability exists in Microsoft Internet Information Server (IIS) which could disclose sensitive information contained in CGI-type files. Typically a CGI/script file on a web server should only be executable and not readable by remote users. Sensitive information contained in such a file might include user credentials for access to a back-end database.
IIS contains a technology called ISAPI (Internet Services Application Programming Interface) which is designed to allow programmers to write custom applications which run on IIS. One ISAPI extension uses .HTR scripts to provide a password management interface via IIS. The .HTR ISAPI extension is implemented in the file ISM.DLL. When IIS receives a request for a file ending in .HTR it performs some pre-processing of the request then passes it off to ISM.DLL. If a malicious user crafts an HTTP request for an existing non-.HTR file and appends a large number of "%20" characters and "+.HTR" to the request, ISM.DLL strips out the spaces in the file name and processes the requested file as if it were an .HTR file. Note that "%20" is a unicode representation of the character " " (space). If the requested file is not an .HTR file then the contents of the file will be returned to the requestor, with the exception of text enclosed in script delimiters "<% %>".
Microsoft Knowledge Base article Q260069 states:
The contents of files may be disclosed to unauthorized remote users. Target files may be CGI scripts that contain sensitive configuration information such as database access credentials. This specific vulnerability does not allow an attacker to access files located outside the root directory of the web server.
Disable .HTR script mapping if not needed, as described in Microsoft Security Bulletin MS01-004:
It may be possible to use an application layer filter to detect and block malicious requests.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Microsoft||Affected||-||15 Jun 2001|
CVSS Metrics (Learn More)
- VU#264272, VU#28565
The CERT Coordination Center acknowledges and thanks David Litchfield of Cerberus Information Security/@Stake and Microsoft Product Security for information used in this document.
This document was written by Art Manion.
- CVE IDs: CVE-2000-0457
- Date Public: 11 May 2000
- Date First Published: 25 May 2001
- Date Last Updated: 07 Aug 2001
- Severity Metric: 13.17
- Document Revision: 43
If you have feedback, comments, or additional information about this vulnerability, please send us email.