%5c类的漏洞 in asp/asp.NET
Microsoft ASP.NET vulnerability (updated Oct. 7th)
Microsoft announced a possible vulnerability in ASP.NET (http://www.microsoft.com/security/incident/aspnet.mspx ). There are not much details so far, but it refers to the "canonicalization" functionality and suggest to implement then hardening measures outlined in KB887459 (http://support.microsoft.com/?kbid=887459 ).
It appears that a particularly crafted request may confuse ASP.Net and allow access to otherwise protected directories.
If a web server receives a request for a particular URL (e.g. _http://server/somedirectory/filename), the 'somedirectory/filename' part has to be mapped to a particular file located on the server. This translation has been the source of many "directory traversal" bugs. The IIS unicode exploit is probably the most famous one.
After our original posting of this diary, a few users pointed to the following articles which provide more details then provided by Microsoft's advisory:
(Thanks to Chaouki & Daniel)
It appears that by switching a '/' character in the URL with '/' or '%5C', the canonicalization routine will be confused. So if the URL:
is password protected, using the either of the following URLs will bypass the restriction:
In addition to the slash/back-slash confusion, one reader reports that inserting a space will bypass the URL restriction as well:
(had no chance to validate this method so far)