%5c类的漏洞 in asp/asp.NET
发表于2004/10/17 0:35:00 1501人阅读
分类： New Skill
Microsoft ASP.NET vulnerability (updated Oct. 7th)
Microsoft announced a possible vulnerability in ASP.NET (http://www.microsoft.com/security/incident/aspnet.mspx ). There are not much details so far, but it refers to the "canonicalization" functionality and suggest to implement then hardening measures outlined in KB887459 (http://support.microsoft.com/?kbid=887459 ).
It appears that a particularly crafted request may confuse ASP.Net and allow access to otherwise protected directories.
If a web server receives a request for a particular URL (e.g. _http://server/somedirectory/filename), the 'somedirectory/filename' part has to be mapped to a particular file located on the server. This translation has been the source of many "directory traversal" bugs. The IIS unicode exploit is probably the most famous one.
After our original posting of this diary, a few users pointed to the following articles which provide more details then provided by Microsoft's advisory:
(Thanks to Chaouki & Daniel)
It appears that by switching a '/' character in the URL with '/' or '%5C', the canonicalization routine will be confused. So if the URL:
is password protected, using the either of the following URLs will bypass the restriction:
In addition to the slash/back-slash confusion, one reader reports that inserting a space will bypass the URL restriction as well:
(had no chance to validate this method so far)
csharp:Learn how to post JSON string to generic Handler using jQuery in ASP.Net C
geovindu1 2014-12-28 19:47 752
Apress.Beginning.ASP.NET.2.0.in.C.Sharp part 2
yukunsong 2007-08-18 09:44 17
chenhaoying 2012-08-16 09:56 1942
josephSC 2011-07-30 03:21 7
kittyjie 2007-09-22 08:29 69
zhangxuyu1118 2007-09-05 14:18 22
zhangxuyu1118 2007-09-05 14:12 20
yanzhibo 2014-02-22 23:24 4275