How to remediate – Microsoft IIS 5.0 Form_JScript.asp XSS

1. Introduction

Microsoft IIS 5.0 Form_JScript.asp XSS is a cross-site scripting vulnerability in an example ASP script hosted on web servers. This allows attackers to inject malicious code into the website, potentially stealing user data or performing actions as a legitimate user. Systems running vulnerable versions of IIS with these sample scripts enabled are affected, and this can impact confidentiality, integrity, and availability.

2. Technical Explanation

• Root cause: Missing input validation in the Form_JScript.asp script allows arbitrary HTML and JavaScript code to be injected into the response.
• Exploit mechanism: An attacker submits malicious JavaScript through the form field, which is then rendered by the server without sanitisation. For example, submitting `` will display an alert box in the user’s browser.
• Scope: Affected platforms are web servers running Microsoft IIS 5.0 with the sample scripts installed.

3. Detection and Assessment

Confirming vulnerability involves checking for the presence of the vulnerable script and testing its behaviour. A quick check can be done by browsing to the affected URL, while a thorough method involves submitting test payloads.

• Quick checks: Browse to http://yourserver/iissamples/sdk/asp/interaction/Form_JScript.asp and verify it is accessible.
• Scanning: Nessus plugin ID 30865 can detect this vulnerability, but results should be verified manually.
• Logs and evidence: Examine IIS logs for requests to the Form_JScript.asp script containing suspicious characters or JavaScript code. Look for patterns in the request query string.

curl -I http://yourserver/iissamples/sdk/asp/interaction/Form_JScript.asp

4. Solution / Remediation Steps

The recommended solution is to remove the sample scripts from the server as they are not required for production environments. This eliminates the vulnerability entirely.

4.1 Preparation

• Ensure you have access to the file system where the sample scripts are stored. A roll back plan is to restore the backup of the IIS configuration.
• A change window may be required depending on your organisation’s policies. Approval from a senior IT administrator might also be needed.

4.2 Implementation

1. Step 1: Delete the /iissamples directory and all its contents using File Explorer or command line tools.
2. Step 2: Restart the web server service if it was stopped in Step 1.

4.3 Config or Code Example

Before

<form method="post" action="/iissamples/sdk/asp/interaction/Form_JScript.asp">

After

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of vulnerability. Input validation is crucial for blocking malicious data, while least privilege limits the impact if an attack succeeds.

• Practice 1: Least privilege – limit the permissions granted to web server processes and accounts to reduce potential damage from a successful exploit.
• Practice 2: Input validation – always validate user input on both the client-side and server-side to prevent malicious code from being processed.

4.5 Automation (Optional)

# PowerShell example to remove the directory (use with caution!)
# Remove-Item -Path "C:inetpubwwwrootiissamples" -Recurse -Force

5. Verification / Validation

Confirming the fix involves verifying that the vulnerable script is no longer accessible and attempting to re-exploit it. A smoke test should also be performed to ensure core functionality remains intact.

• Post-fix check: Attempt to access http://yourserver/iissamples/sdk/asp/interaction/Form_JScript.asp. You should receive a 404 error or similar indicating the resource is not found.
• Re-test: Repeat the curl command from Step 3 and confirm it returns a 404 error.
• Smoke test: Verify that other ASP pages on your website are functioning correctly.
• Monitoring: Monitor IIS logs for any unexpected errors or access attempts to the deleted directory.

curl -I http://yourserver/iissamples/sdk/asp/interaction/Form_JScript.asp

6. Preventive Measures and Monitoring

Regular security baselines and pipeline checks can help prevent similar vulnerabilities in the future. A sensible patch or config review cycle is also important for maintaining a secure environment.

• Baselines: Update your IIS hardening baseline to exclude unnecessary sample scripts.
• Asset and patch process: Establish a regular schedule for reviewing and patching web server configurations, including removing unused components.

7. Risks, Side Effects, and Roll Back

Removing the sample scripts should not impact production environments as they are intended for development purposes only. However, it is important to have a roll back plan in case of unforeseen issues.

• Risk or side effect 1: If other applications rely on these scripts (unlikely), removing them could cause functionality to break.
• Risk or side effect 2: Incorrectly configured permissions during the removal process could lead to access issues.
• Roll back: Restore the IIS configuration backup created in Step 4.1.

8. References and Resources

• Vendor advisory or bulletin: CERT CA-2000-02
• NVD or CVE entry: No specific CVE is listed for this exact script, but related XSS vulnerabilities in IIS can be found on the NVD website.
• Product or platform documentation relevant to the fix: Microsoft IIS Security – Cross-