Description
The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Microsoft ASP.NET 1.x - URI Canonicalization Unauthorized Web Access EDB-24666 · webapps · Oct 6, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- MS05-004 vendor-advisory
- http://sourceforge.net/mailarchive/forum.php?thread_id=5671607&forum_id=24754
- oval:org.mitre.oval:def:4987 vdb-entry signature
- TA05-039A third-party-advisory
- windows-forms-security-bypass(17644) vdb-entry
- oval:org.mitre.oval:def:3556 vdb-entry signature
- VU#283646 third-party-advisory
- 11342 vdb-entry
- 20040914 Security bug in .NET Forms Authentication mailing-list