Microsoft Outlook Web Access (OWA) Anonymous Access

medium Nessus Plugin ID 10781

Synopsis

The remote server is vulnerable to information disclosure.

Description

It is possible to browse the information of the OWA server by accessing as an anonymous user with the following URL:

http://www.example.com/exchange/root.asp?acs=anon

After this access, the anonymous user can search for valid users in the OWA server and can enumerate all users by accessing the following URL:

http://www.example.com/exchange/finduser/details.asp?obj=XXX (where XXX is a string of 65 hexadecimal numbers)

Data that can be accessed by an anonymous user may include: usernames, server names, email name accounts, phone numbers, departments, office, management relationships...

This information will help an attacker to make social engineering attacks with the knowledge gained. This attack can be easily automated since, even if direct access to search is not possible, you only need the cookie given on the anonymous login access.

Administrators might be interested in consulting the following URL:

http://web.archive.org/web/20030805172512/http://support.microsoft.com/support/exchange/content/whitepapers/owaguide.doc

Solution

Disable anonymous access to OWA. Follow these steps:
1. In Microsoft Exchange Administrator open the Configuration container.
2. Choose Protocols, and then double-click HTTP (Web) Site Settings 3. Unselect the 'Allow anonymous users to access the anonymous public folders' check box.
4. Select the Folder Shortcuts tab.
5. Remove all folders which are allowed anonymous viewing.
6. Choose OK.
7. Remove the anonymous access from the login web pages.

Plugin Details

Severity: Medium

ID: 10781

File Name: owa-anonymous.nasl

Version: 1.37

Type: remote

Family: CGI abuses

Published: 10/10/2001

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

Required KB Items: www/ASP

Exploit Ease: No exploit is required

Vulnerability Publication Date: 9/6/2001

Reference Information

CVE: CVE-2001-0660

BID: 3301

Detections

Analytics