Collected research
ASP.NET MVC View Engine Search Patterns
The ASP.NET MVC Razor view engine locates views with internal file-existence checks, so IIS request filtering, which only inspects request URLs, never applies. An attacker holding an arbitrary file write drops a view payload into one of the engine's predictable search paths and triggers it through the extensionless MVC route, gaining code execution.
Record
- Researcher
- Diyan Apostolov
- Published by
- Critical Thinking - Bug Bounty Podcast
- Date
- Topic
- Server
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Diyan Apostolov, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .