CVE-1999-0278 in IIS
Summary
by MITRE
In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/26/2025
This vulnerability exists in Microsoft Internet Information Services (IIS) versions prior to 5.0 and represents a critical information disclosure flaw that allows remote attackers to access sensitive source code files. The vulnerability specifically affects Active Server Pages (ASP) files and exploits a weakness in how IIS handles file system access requests. When an attacker appends the special NTFS alternate data stream identifier "::$DATA" to an ASP file URL, the server inadvertently returns the source code of the ASP file instead of executing it as intended. This occurs because IIS does not properly validate or sanitize file access requests that include NTFS alternate data stream syntax, which is typically used to access hidden data streams within files. The flaw stems from inadequate input validation and improper handling of file system access patterns that should be restricted to prevent unauthorized access to file contents.
The technical implementation of this vulnerability leverages the NTFS file system's alternate data streams feature, which is a Windows-specific capability allowing multiple data streams to be associated with a single file. When IIS receives a request containing the "::$DATA" suffix, it attempts to access the file's alternate data stream rather than executing the file as a web application. This behavior creates an unintended information disclosure channel that bypasses normal execution controls. The vulnerability is particularly dangerous because ASP files often contain sensitive information such as database connection strings, server-side logic, and application configuration details that attackers can exploit to gain deeper access to the system. The flaw operates at the file system level and affects the web server's interpretation of file access requests, making it difficult to detect through standard network monitoring tools.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable more sophisticated attacks. Attackers can use this technique to gather intelligence about web applications, identify security misconfigurations, and discover sensitive data that could be used for further exploitation. The vulnerability affects all IIS versions prior to 5.0 and can be exploited from any remote location without requiring authentication or special privileges. This makes it particularly dangerous for organizations with public-facing web servers, as it allows attackers to systematically harvest source code from multiple ASP applications. The exposure of ASP source code can reveal database credentials, application logic, and other sensitive information that could be used to launch additional attacks, including SQL injection, cross-site scripting, and other application-level exploits. The vulnerability also demonstrates a lack of proper access control implementation at the file system level within the web server's request handling process.
Organizations should implement multiple layers of defense to protect against this vulnerability, beginning with immediate patching of affected IIS versions to 5.0 or later where the issue has been resolved. System administrators should also consider implementing network-level restrictions to prevent access to file system resources through web interfaces and configure proper file system permissions to limit access to sensitive files. Security monitoring should be enhanced to detect unusual patterns in file access requests, particularly those containing NTFS alternate data stream syntax. The vulnerability aligns with CWE-200, which addresses improper exposure of sensitive information, and represents a specific instance of information disclosure through improper input validation. From an ATT&CK framework perspective, this vulnerability maps to techniques involving credential access and reconnaissance, as attackers can use the disclosed information to plan more targeted attacks. Organizations should also consider implementing web application firewalls and regular security assessments to identify similar vulnerabilities in their web server configurations and ensure proper isolation between web content and underlying file system access mechanisms.