Reported October 28, 2000 by Georgi Guninski

VERSIONS AFFECTED
  • Microsoft Internet Information Server 5.0
  • Microsoft Index Server

DESCRIPTION

Georgi Guninski has discovered a security issue that he believes in present in Internet Information Server 5.0.  By using specifically designed URLs a malicious attacker could retrieve specific content.  One such scenario could lead to cookie stealing.

DEMONSTRATION

The following URL could be used in a link or script and will execute in javascript under iis5server but is defined by the user.

http://iis5server/null.htw?CiWebHitsFile=/default.htm&CiRestriction="

The .htm file specified must exist in order for this to work.

VENDOR RESPONSE

Microsoft has confirmed that this vulnerability exists but says that the problem is present in Microsoft Index Server not Internet Information Server.  Microsoft is currently testing a patch and will release a security bulletin and patch soon.

CREDIT
Discovered by
Georgi Guninski