# Reading ASP secrets for $17,000

ASP.NET download.aspx accepted a filename parameter; bypassing '..' filtering with '.+.' enabled path traversal to read web.config, leaking Azure Key Vault credentials and full secret access.

- Payout: $17,000
- Severity: critical
- Program: -
- Credited: Sam Curry
- Disclosed: 2018-12-16
- Write-up quality: 8/10
- Original: https://samcurry.net/reading-asp-secrets-for-17000/
- Library page: https://bugbountylibrary.com/r/blog%3Asamcurry-net-reading-asp-secrets-for-17000
- Tags: domain:web impact:data-leak impact:internal-access kind:research platform:research sev:critical tech:azure tech:dotnet technique:chained technique:fuzzing vuln:info-disclosure vuln:path-traversal vuln:secrets-leak

**Target:** ASP.NET download.aspx file-download endpoint
**Root cause:** The 'f' parameter was passed to file read without sanitization; the '..' filter was bypassable because '.+.' was treated as a traversal segment by the underlying Windows/ASP.NET file API.
**Steps:**
1. Request `GET /utility/download.aspx?f=download.aspx` to confirm arbitrary file read of the page source.
2. Fuzz `GET /utility/download.aspx?f=.[fuzz]./utility/download.aspx` to find a traversal bypass; `.+./utility/download.aspx` returns source.
3. Read handler source: `GET /utility/download.aspx?f=.+./.+./bin/redacted.dll` and decompile with dnSpy.
4. Read config: `GET /utility/download.aspx?f=.+./.+./web.config` to obtain keyVaultClientId, keyVaultClientSecretIdentifier, vault URIs.
5. Use azure-keyvault + adal-node with client credentials to call `client.getSecrets(vaultUri)` and dump secrets.
**How found:** Noticed an encrypted 'f' parameter on download.aspx, then saw the same endpoint on an older page accepting a plaintext filename. Tried `f=download.aspx` and got source. When `..` was blocked, manually fuzzed characters between dots and found `.+./` traversed. Recalled ASP.NET stores compiled classes in /bin/*.dll and config in web.config; @nahamsec suggested reading web.config.
**Exploitation:** Attacker used the traversal bypass to read web.config, extracted Azure Key Vault client ID/secret/tenant/vault URI, then authenticated via client-credentials flow and enumerated all Key Vault secrets, yielding credentials granting full read/write access to the system.
**Escalation:** Chained LFD -> source/DLL disclosure -> web.config secret disclosure -> Azure Key Vault authentication -> full secret exfiltration and system access.
**Insight:** On ASP.NET LFD, .aspx.cs is often blocked but .ashx handlers and /bin/<class>.dll are readable — decompile DLLs with dnSpy to recover source. Always try web.config for connection strings and cloud credentials (Azure Key Vault client secrets). When '..' is filtered, fuzz single characters between dots; '.+.' bypassed here.