Executive brief
Microsoft Internet Information Services (IIS) 3.0 contains a flaw that allows unauthorized users to view the private source code of web applications. By viewing this code, attackers could discover sensitive business logic, database credentials, or other secrets used by the website. This could lead to further system compromise or the theft of proprietary information.
Technical details
A vulnerability in Microsoft IIS 3.0, specifically when the 'iis-fix' hotfix is applied, allows for source code disclosure of Active Server Pages (ASP). The issue is caused by improper handling of URL-encoded characters; by replacing the dot (.) in a file extension with its hex-encoded equivalent (%2e), the server fails to execute the script and instead serves the raw source code to the requester. This is a remote, unauthenticated attack that can be performed via a standard web browser. Attackers can leverage this to extract sensitive information such as hardcoded credentials or application logic from the server.
Affected products
- Microsoft Internet Information Services (IIS) 3.0 with iis-fix hotfix
Timeline
- 1997-01-01: disclosed: Initial publication date