I get IIS requests with a path after the aspx - why does that work?

Theo Verweij 1 Reputation point
2021-10-16T12:01:37.957+00:00

I am getting URL requests from the internet in the following form:

https://mydomain.xx/mypage.aspx/somepath/anotherpath/anotherpage.aspx

When this is executed, mypage.aspx is shown, but the picture that are loaded from a relative path are not shown.

Why does this call not result in a 404 and what is the attacker trying do do?

Internet Information Services

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bruce (SqlWork.com) 55,366 Reputation points
    2021-10-16T15:42:33.027+00:00

    To the browser the relative path is

    https://mydomain.xx/mypage.aspx/somepath/anotherpath

    Sorry misread question. IIS uses the path to determine the vdir responsible for handing the request. It looks like you defined the application at the site level, so only the domain was used to pick the application.

    I would check your route mapping to see why the path is allowed. It’s probably related to friendly url support.

    0 comments