VULHUB ™

Active Server Pages that have errors in them or in their components can cause error messages to be served to the browser that include path information for included files used in the creation of the .asp file. These files can then be downloaded and may include sensitive information such as resource locations, website and network structure, and business models. In some instances, these faulty .asp pages are indexed by search engines, and it is possible for an attacker to do a search for strings like 'Microsoft VBScript runtime error' to find these pages. Even after the ASP code is fixed, it is possible in some cases to view archived copies of the relevant text from the search engine's cache and therefore retreive the required information. Note that properly implemented and audited ASP will not exhibit this behavior.

Active Server Pages that have errors in them or in their components can cause error messages to be served to the browser that include path information for included files used in the creation of the .asp file. These files can then be downloaded and may include sensitive information such as resource locations, website and network structure, and business models. In some instances, these faulty .asp pages are indexed by search engines, and it is possible for an attacker to do a search for strings like 'Microsoft VBScript runtime error' to find these pages. Even after the ASP code is fixed, it is possible in some cases to view archived copies of the relevant text from the search engine's cache and therefore retreive the required information. Note that properly implemented and audited ASP will not exhibit this behavior.