Microsoft IIS5 NTLM and Basic authentication bypass

Antecedentes

Microsoft Internet Information Server can protect your private content with basic or NTLM authentication, which many websites, intranets, and extranets rely on. IIS 5 includes the "Hit-highlighting" feature, which opens a site object and highlights part of it; in the past, it suffered from a directory traversal vulnerability and now can be used to bypass IIS authentication.

Description

Any Internet user can access the private directories and files of any IIS 5 website by highlighting them with "Hit-highlighting". Simply provide the CiWebhitsfile parameter to the null.htw object, which should be accessed from a non-existent directory, for example http://anyiisweb.com/foo/null.htw. Another object specified in the CiTemplate template can also be used.

Business impact

The impact depends on the website's content: attackers could access all protected documents and the ASP code. By gaining access to a trusted area, the likelihood of achieving command execution increases.

Affected systems

Internet Information Services version 5, with any Service Pack.

Solución

Protect the files using the NTFS file system instead of relying on IIS protection. Microsoft recommends not using IIS 5.

Calendario de divulgación

References

The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness for use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.