A
security vulnerability in ASP.NET has been identified that could allow an attacker to gain access to secured content. This issue centers around how ASP.NET locates files based on file names sent as part of a server request. Microsoft has issued a recommendation to add a check for this attack to your Global.asax file.
What is canonicalization?
Canonicalization is the process by which various equivalent forms of a name can be resolved to a single standard name, or the "canonical" name. For example, on a specific computer, the names c:\dir\test.dat, test.dat, and ..\..\test.dat might all refer to the same file. Canonicalization is the process by which such names are mapped to a name that is similar to c:\dir\test.dat.
To resolve this issue, Microsoft recommends that ASP.NET web developers implement the following code snippet within the Global.asax file.
For VB.NET, add the below code in script runat=server.
Global.asax code sample (Visual Basic .NET)
Sub Application_BeginRequest(Sender as Object, E as EventArgs)
If (Request.Path.IndexOf(chr(92)) >= 0 OR _
System.IO.Path.GetFullPath(Request.PhysicalPath) <> Request.PhysicalPath) then
Throw New HttpException(404, "Not Found")
End If
End Sub
For C#, add the below code in script runat=server.
Global.asax code sample ( C#)
void Application_BeginRequest(object source, EventArgs e)
{
if (Request.Path.IndexOf('\\') >= 0 ||
System.IO.Path.GetFullPath(Request.PhysicalPath) != Request.PhysicalPath)
{
throw new HttpException(404, "not found");
}
}
Get more details
here.