SP question : Microsoft IIS ISAPI Extension Enumerate Root Web Server Directory Vulnerability

[Lee, Dong]

Scott,

Thank you for your quick response.

I have a few questions from your comment.

> The SP is not an ISAPI extension anymore, hasn't been for many years. The supported version is a "modern-ish" IIS module, and I don't think they'd use the same > >terminology for that, ISAPI was usually the term for the old C++ API.

Are you referring to "Modern-ish IIS module" as "Configuring the new plugin" documented in the wiki page titled "Upgrading Older ISAPI Configuration"?

Is this an out-of-the-box configuration or a follow-up task after the installation by using this command 
'appcmd install module /name:ShibNative /image:"c:\opt\shibboleth-sp\lib64\shibboleth\iis7_shib.dll" /precondition:bitness64'?

Thank you,
Dong Lee

Identity Management & System Integration 
Center for Information Technology Services 
University of Maryland, Baltimore
410-706-3027
dlee at umaryland.edu


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Tuesday, June 3, 2025 2:49 PM
To: Shib Users <users at shibboleth.net>
Cc: Lee, Dong <DLee at umaryland.edu>
Subject: Re: SP question : Microsoft IIS ISAPI Extension Enumerate Root Web Server Directory Vulnerability

[You don't often get email from cantor.2 at osu.edu. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

CAUTION: This message originated from a non-UMB email system. Hover over any links before clicking and use caution opening attachments.

The SP is not an ISAPI extension anymore, hasn't been for many years. The supported version is a "modern-ish" IIS module, and I don't think they'd use the same terminology for that, ISAPI was usually the term for the old C++ API.

So one possibility is that the setting wouldn't matter, but I wouldn't know.

Of course, if you're running the old/unsupported SP filter, then that's the first issue to address, as that's a much larger concern.

> However, I could not confirm this information.
> Can you validate whether this is correct?

That it operates on virtual paths? Yes, of course, all of the SP agents do and always will.

> If true, what would be a suitable solution to address the 
> vulnerability while maintaining SP functionality?

I don't consider it a real vulnerability to begin with, so that's a loaded question, but if you need a setting that breaks the SP, then you have a catch-22 obviously, that isn't the sort of thing that could be worked around.

But I wouldn't just assume it's an issue without actually testing it.

-- Scott