Fixing the ASP.NET Authentication Vulnerability
I'm not going to jawjack about how important this fix is, blah blah blah.
Microsoft's working on a patch. In the meantime, EVERY ASP.NET developer should
add this information to their Global.asax file ASAP. If you add it to
the ASAX file and not the code-behind, you won't even have to recompile the app.
DO THIS NOW. Please. More Info
Here.
Global.asax code sample (Visual Basic .NET)
<script language="vb" runat="server">
Sub Application_BeginRequest(Sender as Object, E as EventArgs)
If (Request.Path.IndexOf(chr(92)) >= 0 OR _
System.IO.Path.GetFullPath(Request.PhysicalPath) <> Request.PhysicalPath) then
Throw New HttpException(404, "Not Found")
End If
End Sub
</script>
Global.asax code sample ( C#)
<script language="C#" runat="server">
void Application_BeginRequest(object source, EventArgs e) {
if (Request.Path.IndexOf('\\') >= 0 ||
System.IO.Path.GetFullPath(Request.PhysicalPath) != Request.PhysicalPath) {
throw new HttpException(404, "not found");
}
}
</script>