圆月山庄资源网 Design By www.vgjia.com
Title:Microsoft ASP.NET May Disclose Web Directory to Remote Users in Certain Cases
Description: If the ASP.NET application does not filter the error message, the web
directory information may be disclosed to remote users by using an unavailable file
which start with "~".
Hi, I'm Soroush Dalili from GrayHatz Security Group(GSG).I found new thing in .NET
Framework Version:1.1 (.ASPX Files).
If error mode in .net configuration is on, Run an unavailable aspx file that start with
"~" can cause showing full path in browsers.
For Example: Http://[URL]/~foo.aspx
------------------------------------------------------------------------
Note:Version 2 have not this bug and it return file does not exist
Vendor URL: www.microsoft.com
Version:1.1
Soloution: Update to version 2 or enable error filtering
Finder: Soroush Dalili
Team: GSG [GrayHatz Security group]
Web: grayhatz.net
Country: Iran
Email: Irsdl[a.t]yahoo[d.o.t]com
搜索引擎 inurl:aspx,然后随便点个连接,在url后输入~fly_ocean.aspx,即可暴出绝对路径。
例如:
http://www.fodonline.com/qihuoju/default.aspx~fly_ocean.aspx
用于监视的文件名无效:“D:\aaa\qihuoju\default.aspx~fly_ocean.aspx”。用于监视的文件名必须具有绝对路径,并且不包含通配符。
版本信息: Microsoft .NET Framework 版本:1.1.4322.2300; ASP.NET 版本:1.1.4322.2300
Description: If the ASP.NET application does not filter the error message, the web
directory information may be disclosed to remote users by using an unavailable file
which start with "~".
Hi, I'm Soroush Dalili from GrayHatz Security Group(GSG).I found new thing in .NET
Framework Version:1.1 (.ASPX Files).
If error mode in .net configuration is on, Run an unavailable aspx file that start with
"~" can cause showing full path in browsers.
For Example: Http://[URL]/~foo.aspx
------------------------------------------------------------------------
Note:Version 2 have not this bug and it return file does not exist
Vendor URL: www.microsoft.com
Version:1.1
Soloution: Update to version 2 or enable error filtering
Finder: Soroush Dalili
Team: GSG [GrayHatz Security group]
Web: grayhatz.net
Country: Iran
Email: Irsdl[a.t]yahoo[d.o.t]com
搜索引擎 inurl:aspx,然后随便点个连接,在url后输入~fly_ocean.aspx,即可暴出绝对路径。
例如:
http://www.fodonline.com/qihuoju/default.aspx~fly_ocean.aspx
用于监视的文件名无效:“D:\aaa\qihuoju\default.aspx~fly_ocean.aspx”。用于监视的文件名必须具有绝对路径,并且不包含通配符。
版本信息: Microsoft .NET Framework 版本:1.1.4322.2300; ASP.NET 版本:1.1.4322.2300
标签:
NET,IIS暴绝对路径漏洞
圆月山庄资源网 Design By www.vgjia.com
广告合作:本站广告合作请联系QQ:858582 申请时备注:广告合作(否则不回)
免责声明:本站文章均来自网站采集或用户投稿,网站不提供任何软件下载或自行开发的软件! 如有用户或公司发现本站内容信息存在侵权行为,请邮件告知! 858582#qq.com
免责声明:本站文章均来自网站采集或用户投稿,网站不提供任何软件下载或自行开发的软件! 如有用户或公司发现本站内容信息存在侵权行为,请邮件告知! 858582#qq.com
圆月山庄资源网 Design By www.vgjia.com
暂无评论...
更新日志
2024年05月17日
2024年05月17日
- 张国荣.2011-极品天碟LPCD45II(雨果版)【环球】【WAV+CUE】
- 张学友《醒着做梦》[DFF][1.1G]
- 刘惜君 《如我》[WAV分轨][403M]
- 白玛多吉《梦》限量1:1母盘直刻[低速原抓WAV+CUE][508M]
- 魏金栋-金歌新曲-梦里全是桂花香2CD[天凡之音][WAV+CUE]
- 鲛岛有美子-樱花赋HQCD[天龙][WAV+CUE]
- [In-Akustik7506]ReferenceSoundEdition-GreatWomenOfSong(2014)HQCD[WAV+CUE]
- 日本EMI超级名盘TOGE-11035-36BeethovenFidelio-Furtwngler
- 宝丽金50周年2010《古典篇》3CD限定盘[低速原抓WAV+CUE]
- 华纳群星.1992-永远新一天华纳15周年金钻群星演唱会2CD【华纳】【WAV+CUE】
- 原声《功夫熊猫4 OST》[FLAC][545M]
- 陈奕迅《酝酿》[WAV分轨][502M]
- Taylor Swift《THE TORTURED POETS DEPARTMENT- THE ANTHOLOGY》[320K/MP3][279.09MB]
- 崔健《85回顾+梦中的倾诉》2CD [WAV+CUE][771M]
- 群星《安桥试音碟》3CD[FLAC][1.1G]