Microsoft IIS bdir.htr Arbitrary Directory Listing

medium Nessus Plugin ID 10577

Synopsis

The remote web server is affected by an information disclosure vulnerability.

Description

The file bdir.htr is a default IIS files which can give a malicious user a lot of unnecessary information about your file system.
Specifically, the 'bdir.htr' script allows the user to browser and create files on hard drive. As this includes critical system files, it is highly possible that the attacker will be able to use this script to escalate privileges and gain 'Administrator' access.

Solution

If you do not need these files, then delete them, otherwise use suitable access control lists to ensure that the files are not world-readable.

Plugin Details

Severity: Medium

ID: 10577

File Name: iis_bdir.nasl

Version: 1.31

Type: remote

Family: Web Servers

Published: 12/11/2000

Updated: 6/12/2020

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/a:microsoft:iis

Required KB Items: Settings/ParanoidReport

Vulnerability Publication Date: 12/25/1998

Reference Information

BID: 2280

Detections

Analytics