SP question : Microsoft IIS ISAPI Extension Enumerate Root Web Server Directory Vulnerability

[Cantor, Scott]

The SP is not an ISAPI extension anymore, hasn't been for many years. The supported version is a "modern-ish" IIS module, and I don't think they'd use the same terminology for that, ISAPI was usually the term for the old C++ API.

So one possibility is that the setting wouldn't matter, but I wouldn't know.

Of course, if you're running the old/unsupported SP filter, then that's the first issue to address, as that's a much larger concern.

> However, I could not confirm this information.
> Can you validate whether this is correct?

That it operates on virtual paths? Yes, of course, all of the SP agents do and always will.

> If true, what would be a suitable solution to address the
> vulnerability while maintaining SP functionality? 

I don't consider it a real vulnerability to begin with, so that’s a loaded question, but if you need a setting that breaks the SP, then you have a catch-22 obviously, that isn't the sort of thing that could be worked around.

But I wouldn't just assume it's an issue without actually testing it.

-- Scott