I am auditing a possible vulnerable piece of ASP code on a Windows enviroment. The code is as follows:
If InStr(strPath, "\Only\Download\From\Here\", CompareMethod.Text) = 0 Then
Basicly it is supposed to only let the download script fetch files from that location. Webserver has directory traversal turned off. This means that the following submit will not work and will in fact return a 403 forbidden:
Because the function sais "InStr" instead of "BeginsWith" (psuedo code) it only checks if the String contains the path, but not in fact begins with the path.
The following submit will pass the If clause, but will return in a file not found:
The nullbyte injected here does not do anything and it tries to find the file matching the entire string. I've also tried injecting CRLF, #, ; and more.
My question is then if there is any way I can submit a query string that would successfully download arbitrary files? Is there any way to submit a file URI that will fetch me a file and in a way commenting out the /Only/Download/From/Here.
Edit: To summarize I am looking for some kind of way to "comment" out the last part of the filename, either through a bug/feature/vulnerability in ASP, Webserver or windows's handling of files.