This is a quick post to inform the users of our group that a security vulnerability was found in ASP.NET that could potentially allow a Malicious Party access to your web.config file. As you know there are a number of settings in the web.config that would be harmful in the wrong hands, including the Connection String to a (or multiple) Database(s), Encryption Key information (Machine Key), as well as SMTP or Impersonation details which could give the Hacker access to a Windows System Account, or an Administrative Email Account.
Be sure to ready Scott Guthrie’s Post “Important: ASP.NET Security Vulnerability” which will outline the potential threats in more detail.
For a script to detect if you are Vulnerable to this attack read Microsoft Security Research and Defense entry.
There is also a newer update by the Microsoft Security Response Center which includes a twitter account [@MSFTSecResponse] which will give more up-to-date coverage as new developments unfold.
Please make sure to make your superiors aware of this threat as it affects mostly all installations/Versions of ASP.NET on a wide range of Operating Systems.
