Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 2 down vote favorite

I investigated a situation where 300+ websites hosted on an IIS server were pwned by a hacker. Investigation led me to a text file that contained malicious ASP-classic code. The file was named dz.asp;.txt and I just realized that IIS happily executed this file without complaining.

So my question is: is this behavior normal? Shouldn't IIS treat this file as a .txt file instead of .asp?

share|improve this question

1 Answer

up vote 3 down vote accepted

It became known in 2009 that IIS had a vulnerability in that it determined filetype by the part of the filename preceeding a semicolon if there was one in the name.

See this NIST description for more details.

share|improve this answer
Did they ever fix it? – Salman A Aug 30 '12 at 12:31
This is a good example of why whitelists/blacklists just aren't good enough. You should always store user-uploaded data outside of the docroot and use a passthrough script to display it back to the user. – Tom Marthenal Sep 2 '12 at 12:18
mgkrebbs - over at Area 51, you signed up as a follower on the Genealogy Q&A proposal. bit.ly/U3vnDX We're now in Commitment Phase. It would really help the proposal get to Beta if you could "Commit". Sorry to add this comment here, but it was the only way I could see to contact you. – lkessler Sep 16 '12 at 15:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.