Directory Listings can be Obtained From Microsoft IIS Server

Reported October 4, 2000 by @stake

VERSIONS AFFECTED

Internet Information Server 5.0 with Microsoft Index Server

DESCRIPTION

Microsoft Internet Information Server 5.0, with Microsoft Index Server installed has been found to be vulnerable to an exploit that allows unauthorized directory listings to be leaked.

DEMONSTRATION

It is important to note that Microsoft Index Server must be installed in order for this exploit to work. As provided by @stake, the following request could allow a malicious user to obtain directory listings from directories that are not normally available;

SEARCH /HTTP/1.1
Host: 127.0.0.1
Content-Type: text/xml
Content-Length: 133

Select "DAV:displayname" from scope ()

VENDOR RESPONSE

Microsoft has released a knowledge base article available at; http://www.microsoft.com/technet/support/kb.asp?ID=272079

It is also recommended that if Index Server is required that any sensitive files be stored on directories that are not indexed or have READ permissions removed.

CREDIT
Discovered by @stake

Comments

Plain text