Microsoft ASP.NET Request Validation Null Byte Filter Bypass Vulnerability

Bugtraq ID:	8562
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 08 2003 12:00AM
Updated:	Sep 08 2003 12:00AM
Credit:	Discovery is credited to "WebCohort Research" <[email protected]>.
Vulnerable:	Microsoft ASP.NET 1.1
Not Vulnerable:

Microsoft ASP.NET Request Validation Null Byte Filter Bypass Vulnerability

Request Validation, a feature included in ASP.NET 1.1, may not adequately sanitize hostile user-supplied input. ASP scripts that depend on Request Validation to sanitize user-supplied input may still be prone to cross-site scripting or HTML injection attacks as a result. Request Validation may be bypassed by including a null byte (%00) in malicious user-supplied input.

It should be noted that this can also create a false sense of security, since the expectation is that Request Validation should sufficiently sanitize hostile input.

Microsoft ASP.NET Request Validation Null Byte Filter Bypass Vulnerability

There is no exploit required.

Microsoft ASP.NET Request Validation Null Byte Filter Bypass Vulnerability

Solution:
Microsoft has addressed this issue in a Hotfix rollup package and is available by contacting the vendor. Further information can be obtained from the following link:

http://support.microsoft.com/default.aspx?kbid=821156

Microsoft ASP.NET Request Validation Null Byte Filter Bypass Vulnerability

References:

• Microsoft Knowledge Base Article - 821156 (Microsoft)
  
• Microsoft Knowledge Base Article - 821349 (Microsoft)
  
• Advisory: Incorrect Handling of XSS Protection in ASP.Net ("WebCohort Research" )