Search code examples
iiswebsecurity

With IIS 8 hosted application: Vulnerability (CVE-1999-0450) Application root path disclosed when http get is called with random file name

I am running ASP.NET app on IIS 8. In the lines of security vulnerability CVE-1999-0450, when I make http get with .pl/.idq/random file extension the whole application root path is exposed as in the image below. usually, unmapped/random file extensions are handled by static file handler.

enter image description here

I tried below two options but could not stop exposing root path.

  1. For static file handler Mapping->Edit->Request Restriction->checked Invoke handler only if request is mapped to file.

  2. removed static file handler mapping. In this case request is not handled by any handler but still root path is exposed.

    How do I avoid it? One option I am thinking is to turn off detailed error for remote users in IIS->Site->Error settings. Any other suggestions to fix this security vulnerability?

Solution

  • As far as I know, the THE CVE is for IIS versions 2 to 5 and from 1999 and it is just for Perl.It is solved after IIS 6.

    If you don't turn off detailed error for remote users, it will always show the Physical Path for the application's administrator to find out the reason more easily.This is not a security vulnerability.

    How do I avoid it? One option I am thinking is to turn off detailed error for remote users in IIS->Site->Error settings. Any other suggestions to fix this security vulnerability?

    In my opinion, turn off detailed error for remote users in IIS is the best choice to avoid showing the extension.