Multiple Web Server Encoded Space

Plugin 11071 is a generic active check for a very old bug pattern where requesting a dynamic script with a trailing encoded space (%20) can make the server return the source code instead of executing it. Tenable maps it to at least CVE-2001-1248 (vWebServer 1.2.0) and CVE-2007-3407 (shttpd 1.38), and its own description also mentions Mono XSP for ASP.NET 1.1/2.0. The exposed data can include application logic, connection strings, and sometimes credentials in config files.

The vendor's MEDIUM label is already a little generous for modern enterprise prioritization. Yes, the attack is unauthenticated and remote, but the reachable population is tiny: the named products are obsolete, niche, or both, the plugin is pattern-based rather than product-specific, and many findings on modern stacks will be false positives until you actually reproduce source disclosure on a live ASP/ASPX endpoint.

Why this verdict

• Downward pressure: requires a legacy parser bug on a niche web stack — unauthenticated remote is bad in theory, but the affected population is heavily constrained by product age and rarity.
• Downward pressure: product-specific reality is narrower than the plugin name suggests — the check is generic and maps to a bug family, so many modern findings need reproduction before they deserve engineering time.
• Downward pressure: impact is confidentiality-only at the bug boundary — source disclosure can aid later compromise, but it is not direct RCE, auth bypass, or domain-wide blast radius.

Why not higher?

This is not higher because the attack chain has two strong brakes: first, you need an actually affected legacy server/parser combination; second, source disclosure only becomes severe when the returned code contains secrets or exposes a second exploitable flaw. In a 10,000-host environment, those prerequisites dramatically shrink both reachable population and expected business impact.

Why not lower?

This is not IGNORE because a true positive can still leak credentials, business logic, and config that materially assists follow-on intrusion. If you can reproduce raw source or web.config disclosure on a reachable app, you still have a real security defect that should be cleaned up.

1. Reproduce before you escalate — Use a manual request against a known .asp or .aspx endpoint and verify whether the server returns raw source instead of rendered output. For a LOW verdict there is no SLA (treat as backlog hygiene), but validation should happen before you burn application-team cycles.
2. Retire or isolate niche legacy web servers — If the host is actually running shttpd, vWebServer, or old Mono XSP, move it behind a modern reverse proxy or remove direct exposure. For LOW, there is no mitigation SLA, but legacy web stacks belong in planned decommission work rather than permanent exception lists.
3. Normalize and block malformed paths — Configure your reverse proxy, WAF, or front-end server to reject or canonicalize requests ending in encoded whitespace on script-like paths. This is a practical containment step for real positives, even though LOW findings have no formal mitigation SLA.
4. Scrub secrets from source and config — Assume disclosed code may expose credentials, connection strings, API keys, or admin paths. If a finding reproduces, rotate embedded secrets and move them into a proper secret store; for LOW, handle this as backlog hygiene unless the reproduction shows active credential exposure.

Run this from an auditor workstation with HTTP reachability to the target site. Invoke it as python3 verify_11071.py https://target.example /default.aspx,/app/login.aspx or just python3 verify_11071.py https://target.example to use built-in candidate paths; no privileges are required.

#!/usr/bin/env python3
# verify_11071.py
# Tests for trailing-encoded-space source disclosure associated with Nessus plugin 11071.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN/ERROR

import sys
import re
from urllib.parse import urljoin

try:
    import requests
except Exception:
    print('UNKNOWN - missing dependency: pip install requests')
    sys.exit(2)

DEFAULT_PATHS = [
    '/default.asp',
    '/default.aspx',
    '/index.asp',
    '/index.aspx',
    '/login.asp',
    '/login.aspx'
]

SOURCE_MARKERS = [
    r'<%[@=]?',
    r'Response\.',
    r'Request\.',
    r'Server\.',
    r'Session\.',
    r'Language\s*=\s*VBScript',
    r'<configuration',
    r'<appSettings',
    r'<connectionStrings',
    r'using\s+System\.',
    r'namespace\s+[A-Za-z0-9_.]+'
]

def fetch(url):
    try:
        r = requests.get(url, timeout=10, allow_redirects=True, headers={'User-Agent': 'noisgate-plugin-11071-check/1.0'})
        return r.status_code, r.headers.get('Content-Type', ''), r.text
    except Exception as e:
        return None, '', str(e)


def score_source(text):
    score = 0
    for pat in SOURCE_MARKERS:
        if re.search(pat, text, re.IGNORECASE):
            score += 1
    return score


def main():
    if len(sys.argv) < 2:
        print('UNKNOWN - usage: python3 verify_11071.py <base_url> [comma-separated-paths]')
        sys.exit(2)

    base = sys.argv[1].rstrip('/') + '/'
    paths = DEFAULT_PATHS
    if len(sys.argv) >= 3 and sys.argv[2].strip():
        paths = [p if p.startswith('/') else '/' + p for p in sys.argv[2].split(',')]

    saw_candidate = False

    for path in paths:
        normal_url = urljoin(base, path.lstrip('/'))
        test_url = normal_url + '%20'

        n_status, n_ct, n_body = fetch(normal_url)
        t_status, t_ct, t_body = fetch(test_url)

        if t_status is None:
            continue

        n_score = score_source(n_body if isinstance(n_body, str) else '') if n_status else 0
        t_score = score_source(t_body if isinstance(t_body, str) else '')

        # Candidate if malformed request succeeds and looks more like raw source/config than the normal page.
        if t_status == 200 and t_score >= 2 and t_score > n_score:
            print(f'VULNERABLE - {test_url} returned content that looks like source/config disclosure')
            sys.exit(1)

        # If we reached a page and it did NOT disclose source, count that as evidence toward patched/not vulnerable.
        if n_status in (200, 401, 403, 404) or t_status in (200, 400, 401, 403, 404):
            saw_candidate = True

    if saw_candidate:
        print('PATCHED - no source disclosure observed on tested paths')
        sys.exit(0)

    print('UNKNOWN - no useful paths reached; provide known ASP/ASPX paths as the second argument')
    sys.exit(2)

if __name__ == '__main__':
    main()

Sources

1. Tenable Nessus Plugin 11071
2. NVD CVE-2001-1248
3. NVD CVE-2007-3407
4. Bugtraq: Mono XSP ASP.NET Server sourcecode disclosure vulnerability
5. Bugtraq: HTTP SERVER (httpsv1.6.2) source code disclosure
6. CISA Known Exploited Vulnerabilities Catalog
7. Vulners CVE-2001-1248 entry
8. Feedly CVE-2007-3407 tracker