It was found that the download facility of Microsoft SharePoint Team Services can be abused to reveal the source code of ASP.NET files. Insufficient validation in the input parameters of the download facility can result in the source code of ASP.NET files being disclosed. For example, the source code of the default ASP.NET page available after installing the product (http://server/Pages/Default.aspx) can be obtained by issuing the following request: http://server/_layouts/download.aspx?SourceUrl=/Pages/Default.aspx&Source=http://server/Pages/Default.aspx&FldUrl= In order to retrieve the source code any file stored in the backend database (files whose path does not start with /_layout/) it is sufficient to craft a request that follows this pattern: http://server/_layouts/download.aspx?SourceUrl=<relative_path>&Source=<full_path>&FldUrl= This bug can result in disclosure of sensitive information that can be used by an attacker targeting the application.