VBScript Security Issue: Server.Execute and Dynamically-Generated Files

From: Jonathan Cook (JCook@foothilltransit.org)
Date: 02/25/02 

From: Jonathan Cook <JCook@foothilltransit.org>
To: "Focus-MS (focus-ms@securityfocus.com)" <focus-ms@securityfocus.com>
Date: Mon, 25 Feb 2002 13:51:29 -0800

I am working on a content management system for one of my websites, which
writes static HTML pages from the database-driven CMS.

Which file is returned by my scripts is dynamically determined and the HTML
returned to the client using Server.Execute

I have not done extensive testing but I know that if server-side script is
written in the "articles" and saved as a static file that it will be
executed when the file is returned to the client using Server.Execute.

My question is what combination of directory security, file naming
conventions and scripting functions can negate the threat that breaking into
the CMS could result in the execution of arbitrary code by an attacker.

I am already doing some Replace() stuff in the function that writes the
file, but I am wary of placing all my eggs in that basket and overlooking
some way to call or combination of whitespace which could be used by an
attacker.

Best,
Jonathan