Microsoft IIS 4.0/5.0 / Frontpage Server Extensions 1.1 and prior Local Path Disclosure Vulnerability

vendor:

IIS and Frontpage Server Extensions

by:

SecurityFocus

7.5

CVSS

HIGH

Local Path Disclosure

200

CWE

Product Name: IIS and Frontpage Server Extensions

Affected Version From: Microsoft IIS 4.0/5.0 / Frontpage Server Extensions 1.1 and prior

Affected Version To: N/A

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2002

Microsoft IIS 4.0/5.0 / Frontpage Server Extensions 1.1 and prior Local Path Disclosure Vulnerability

Passing a path to a non-existent file to the shtml.exe or shtml.dll (depending on platform) program will display an error message stating that the file cannot be found accompanied by the full local path to the web root.

Mitigation:

Ensure that the web server is running the latest version of Microsoft IIS and Frontpage Server Extensions.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1174/info

The local path of a HTML, HTM, ASP, or SHTML file can be disclosed in Microsoft IIS 4.0/5.0 / Frontpage Server Extensions 1.1 and prior. Passing a path to a non-existent file to the shtml.exe or shtml.dll (depending on platform) program will display an error message stating that the file cannot be found accompanied by the full local path to the web root. For example, performing a request for http://target/_vti_bin/shtml.dll/non_existant_file.html will produce an error message stating "Cannot open "C:\localpath\non_existant_file.html": no such file or folder"

http://target/_vti_bin/shtml.exe/non-existent-file.html
http://target/_vti_bin/shtml.exe/non-existent-file.htm
http://target/_vti_bin/shtml.exe/non-existent-file.shtml
http://target/_vti_bin/shtml.exe/non-existent-file.asp
http://target/_vti_bin/shtml.dll/non_existant_file.html