Windows Short Filename

Summary #

Netsparker identified a Windows Short File/Folder name disclosure.

The vulnerability is caused by the tilde character (~) with the old DOS 8.3 name convention in an HTTP request. It allows a remote attacker to disclose file and folder names that is not supposed to be accessible.

Impact #

Attackers could find important files that are normally not accessible from the outside and gain intelligence about the application infrastructure. This may cause the leakage of files containing sensitive information such as credentials, configuration files and maintenance scripts.

Remediation #

For Windows Server 2012 and after

Set value to "1" of the NtfsDisable8dot3NameCreation registry key in HKLM\SYSTEM\CurrentControlSet\Control\FileSystem
Open the Command Line with administrator rights and run the command below.
```
C:\Windows\System32>FSUTIL.exe 8dot3name set C: 1
```

For Windows Server 2008 and before

Set value to "1" of the NtfsDisable8dot3NameCreation registry key in HKLM\SYSTEM\CurrentControlSet\Control\FileSystem

Open the Command Line with administrator rights and run the command below.
```
C:\Windows\System32>FSUTIL.exe behavior set disable8dot3 1
```
Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on your computer.

Classifications #

PCI v3.1-6.5.8; PCI v3.2-6.5.8; CAPEC-87; CWE-538; HIPAA-164.306(a), 164.308(a); ISO27001-A.8.2.3; WASC-34; OWASP 2013-A7; OWASP 2017-A6