Mono XSP ASP.NET Server sourcecode disclosure vulnerability

2006.12.29
Risk: Medium
Local: Yes
Remote: Yes
CWE: CWE-Other


Ogólna skala CVSS: 5/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Brak
Wpływ na dostępność: Brak

Mono XSP ASP.NET Server sourcecode disclosure vulnerability Version: Tested on mono 1.2.1 XSP for ASP.NET 1.1 and 2.0 (This is a regression as this issue didn't exists in Mono 1.0) Discovered by: Jos Ramn Palanco: jose.palanco(at)eazel(dot)es http://www.eazel.es Time Line: * Nov 29, 2006: Discovered security issue by Jose Ramon Palanco * Nov 30, 2006: Reported to Mono Project * Dec 1, 2006: Patch in subversion rev 68776 * Dec 5, 2006: Mono is testing the patch and building packages for the fix * Dec 19, 2006: Published advisory Description: Attackers use source code disclosure attacks to try to obtain the source code of server-side applications. The basic role of Web servers is to serve files as requested by clients. Files can be static, such as image and HTML files, or dynamic, such as ASPX, ASHX, ASCX, ASAX, webservices like ASMX files and any language supported by Mono like: C#, boo, nemerle, vb files: .cs, .boo, vb, .n, ... When the browser requests a dynamic file, the Web server first executes the file and then returns the result to the browser. Hence, dynamic files are actually code executed on the Web server. Using a source code disclosure attack, an attacker can retrieve the source code of server-side file. Obtaining the source code of server-side files grants the attacker deeper knowledge of the logic behind the Web application, how the application handles requests and their parameters, the structure of the database, vulnerabilities in the code and source code comments. Having the source code, and possibly a duplicate application to test on, helps the attacker to prepare an attack on the application. An attacker can cause source code disclosure using adding %20 (space char) after the uri, for example http://www.server.com/app/Default.aspx%20 Update: is also possible retrieve Web.Config file. This file contains sensible informatin like credentials. Original advisory: http://www.eazel.es/advisory007-mono-xsp-source-disclosure-vulnerability .html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top