IIS ASP Parent Paths -- iis security

David Wang [Msft]
11/7/2005 10:29:11 PM

Mostly, it is a security concern in shared environments since it allows the
customer to "hop out" of their assigned directory to open any other file on
the system accessible to the authenticated identity.

For example, suppose you have the OS installed on C:\WINDOWS and an ASP page
at C:\Inetpub\wwwroot\Customer1\ParentPath.asp which contains the following
line of text:



When you make a request to /Customer1/ParentPath.asp, the contents of
WIN.INI is returned.

Obviously, this is bad in a shared hosting scenario (suppose it said
...\Customer2\Secret.asp), but if you are not hosting untrusted parties, this
is not a big threat.

Scripting.FileSystemObject presents a similar problem-- once an ASP page can
call Server.CreateObject( "Scripting.FileSystemObject" ) , it can use it to
open any file on the server that the remote authenticated user has access
to.

All these things are pretty well known and by-design. This code is not
running in a sand-box, so you can only use user identity, not physical
location, for isolation.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
Hello,

I have a website programed in asp and it needs parent paths to operate
correctly.
I have heard of parent paths being very risky. What are the issues with this
type of setup?

Thank you
Joe

Joe
11/8/2005 7:19:06 PM

Hello David,

Thank you for your reply it helped very much.

I am the one ecommerce site.(and the host) However my other sites that I
host are not a threat. But what about the rest of the "world" on shopping on
my site?

Thank you
Joe

[quoted text, click to view]

David Wang [Msft]
11/9/2005 1:31:23 AM

As always, it depends on how you programmed your website.

Parent Paths allow a certain behavior. Whether that behavior is a threat
depends on who has access to it and how much control -- and that obviously
depends on how you programmed the website.

You want to read the following blog entry to understand what security means:
http://blogs.msdn.com/david.wang/archive/2005/10/01/Thoughts_on_IIS_Security_vs_Apache_Part_2.aspx.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
Hello David,

Thank you for your reply it helped very much.

I am the one ecommerce site.(and the host) However my other sites that I
host are not a threat. But what about the rest of the "world" on shopping on
my site?

Thank you
Joe

[quoted text, click to view]

Joe
11/10/2005 5:24:02 PM

Thank you for all the help very much appreciated!

J0e

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about iis security

iis security : IIS ASP Parent Paths