SecuriTeam - Microsoft SharePoint 2007 ASP.NET Source Code Disclosure（情報元のブックマーク数）
SharePoint 2007 ASP.NETでソースコードが見えてしまう脆弱性が発見らしい。
Insufficient validation in the input parameters of the download facility can result in the source code of ASP.NET files being disclosed. For example, the source code of the default ASP.NET page available after installing the product (http://server/Pages/Default.aspx) can be obtained by issuing the following request:
Microsoft SharePoint 2007 ASP.NET Source Code Disclosure
http://server/_layouts/download.aspx?SourceUrl=/Pages/Default.aspx&Source=http://server/Pages/Default.aspx&FldUrl=
In order to retrieve the source code any file stored in the backend database (files whose path does not start with /_layout/) it is sufficient to craft a request that follows this pattern:
http://server/_layouts/download.aspx?SourceUrl=&Source=&FldUrl=
This bug can result in disclosure of sensitive information that can be used by an attacker targeting the system. For instance the PublicKeyTokens of the ASP.NET assemblies deployed in the server can be revealed enabling an attacker to upload a malicious file that makes use of them.
