Gaping Security Hole A Pain In The ASP
- 0
- Add a Comment
A gaping hole has just been discovered in Microsoft’s ASP.NET product,
which allows access to password protected areas of a Web site just by
altering the URL for access. According to an article published by
Netcraft today, the issue involves “a bug in ASP.NET’s handling of
URLs, known as “canonicalization.” If visitors to an ASP.NET site
substitutes ‘\’ or ‘%5C’ for the ‘/’ character in the URL, they may be
able to bypass password login screens. The technique may also work if a
space is substituted for the slash […]
