Index Server Vulnerable To Information Stealing

Reported October 28, 2000 by Georgi Guninski

VERSIONS AFFECTED

DESCRIPTIONGeorgi Guninski has discovered a security issue that he believes in present in Internet Information Server 5.0.  By using specifically designed URLs a malicious attacker could retrieve specific content.  One such scenario could lead to cookie stealing.

DEMONSTRATION

The following URL could be used in a link or script and will execute in javascript under iis5server but is defined by the user.

http://iis5server/null.htw?CiWebHitsFile=/default.htm&CiRestriction="

The .htm file specified must exist in order for this to work.

VENDOR RESPONSE

Microsoft has confirmed that this vulnerability exists but says that the problem is present in Microsoft Index Server not Internet Information Server.  Microsoft is currently testing a patch and will release a security bulletin and patch soon.

CREDITDiscovered by Georgi Guninski