Warning This procedure may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this procedure but are providing this information so that you can implement this procedure at your own discretion. Use this procedure at your own risk.
The following script will disable the default behavior in ISA Server 2006 Service Pack 1 and enable the ISA Server to allow URLs that contain carriage returns (CR) or linefeeds (LF) in the URL address. To use this script, follow these steps.
ImportantNote Disabling this default behavior of ISA Server 2006 SP1 (in order to accommodate such applications) could also enable ISA Server to potentially allow the URLs that have been specifically crafted for �cross-site request forgery� attacks when ISA Server uses Form Based Authentication.
- Start Notepad.
- Paste the following script into a new document.
Const SE_VPS_GUID = "{143F5698-103B-12D4-FF34-1F34767DEabc}"
Const SE_VPS_NAME = "AllowNewlineInURL"
Const SE_VPS_VALUE = true
Sub SetValue()
' Create the root object.
Dim root ' The FPCLib.FPC root object
Set root = CreateObject("FPC.Root")
'Declare the other objects needed.
Dim array ' An FPCArray object
Dim VendorSets ' An FPCVendorParametersSets collection
Dim VendorSet ' An FPCVendorParametersSet object
' Get references to the array object
' and to the network rules collection.
Set array = root.GetContainingArray
Set VendorSets = array.VendorParametersSets
On Error Resume Next
Set VendorSet = VendorSets.Item( SE_VPS_GUID )
If Err.Number <> 0 Then
Err.Clear
' Add the item
Set VendorSet = VendorSets.Add( SE_VPS_GUID )
CheckError
WScript.Echo "New VendorSet added... " & VendorSet.Name
Else
WScript.Echo "Existing VendorSet found... value- " & VendorSet.Value(SE_VPS_NAME)
End If
if VendorSet.Value(SE_VPS_NAME) <> SE_VPS_VALUE Then
Err.Clear
VendorSet.Value(SE_VPS_NAME) = SE_VPS_VALUE
If Err.Number <> 0 Then
CheckError
Else
VendorSets.Save false, true
CheckError
If Err.Number = 0 Then
WScript.Echo "Done with " & SE_VPS_NAME & ", saved!"
End If
End If
Else
WScript.Echo "Done with " & SE_VPS_NAME & ", no change!"
End If
End Sub
Sub CheckError()
If Err.Number <> 0 Then
WScript.Echo "An error occurred: 0x" & Hex(Err.Number) & " " & Err.Description
Err.Clear
End If
End Sub
SetValue - On the File menu, click Save As, and then save the file as AllowNewlineInURL.vbs.
- At a command prompt, type the following command, and then press Enter:
cscript AllowNewlineInURL.vbs
To return to the default behavior in ISA Server 2006 Service Pack 1 to block URLs that might contain cross-site request forgery attacks when you use Form Based Authentication, follow these steps:
- Start Notepad, and then open the AllowNewlineInURL.vbs script.
- Locate the following line of code in the script.
Const SE_VPS_VALUE = true
- Change the code to the following line:
Const SE_VPS_VALUE = false
- On the File menu, click Save.
- At a command prompt, type the following command, and then press Enter:
cscript AllowNewlineInURL.vbs