1&1 Windows Shared Hosting Vulnerability
There is a security hole that may be effecting thousands of 1&1 customers.
The bug/hole is as follows:
On ANY microsoft shared hosting site with 1&1, navigate to the home page, e.g. “http://www.1and1.co.uk/”.
Amend the URL to add a non-existant asp file with Get variables applied that include “;” or “%3B” (the escape/encoded version of the character).
i.e. “http://www.1and1.co.uk/qwerty.asp?;”
-Obviously replace “1and1.co.uk” with your domain name.
Hey presto, you get a listing of all files and folders in the sites root directory!
It should show a 404 error, but instead shows the directory.
Not a huge problem, but may expose sensitive files and any non public directories for potential hackers to probe.
Tags: 1&1, hacking, hole, Hosting, server, Shared, Vulnerability, Windows