asp.net - IIS波浪号漏洞问题

Question

以下是我们网站上遇到的问题:

使用 Windows 文件系统简写字符和状态返回代码进行文件/目录名称暴力破解

It is possible to find an unknown filename up to six characters by using shorthand file characters such as ~1 and
    *Example: site.com/admin/uplo*~1*/.aspx
This attack relies on reading different error codes the webserver responds with when the file(s) exist or not. Let’s say the file upload.aspx exists in the directory admin. Our attacks responses would look like this:
    site.com/admin/uplo*~1*/.aspx – IIS returns HTTP 404 File Not Found (valid file)
    site.com/admin/uplp*~1*/.aspx – IIS returns HTTP 400 Bad Request (invalid file)
        *Note that IIS 7.x responds with different error codes (0×0 when valid) instead of http status codes

更多详情 http://www.alertlogic.com/internet-information-server-iis-exploitation-2/

可能的解决方案之一:... 如果可能，您可能需要考虑使用 URL 重写来不允许接受任何带有波浪号字符的 URL...

问题:怎么做？ url重写规则中应该使用什么正则表达式才能丢弃网站上所有URL中的~字符(ASP.NET 3.5)

Answer 1

可以通过执行以下任一操作来修复此问题:

1. Install .NET 4.0 on the web server. 

或者

2. Install and configure IIS URLScan module (do not allow ~ chars in the URL by adding ~ to [DenyUrlSequences] section).

在此处查找更多有用信息: http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx