Vulnerability record · CVE-1999-0278 · published 1 June 1998
CVE-1999-0278: IIS ASP source code disclosure via ::$DATA URL suffix
Microsoft · Internet Information Server
Microsoft IIS fails to properly handle NTFS alternate data stream syntax in URLs, allowing remote attackers to retrieve the source code of ASP files by appending "::$DATA" to the request. Because ASP source often contains credentials, connection strings and business logic, disclosure of the raw file is a meaningful information leak rather than a mere nuisance.
Description
In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.
AV:N/AC:L/Au:N/C:P/I:N/A:N
Automated analysis
high priorityUnauthenticated remote source code disclosure with a very high EPSS percentile, though the affected platform is legacy and the CVSS base score is only medium.
What it is
Microsoft IIS fails to properly handle NTFS alternate data stream syntax in URLs, allowing remote attackers to retrieve the source code of ASP files by appending "::$DATA" to the request. Because ASP source often contains credentials, connection strings and business logic, disclosure of the raw file is a meaningful information leak rather than a mere nuisance.
Impact
An unauthenticated attacker gains read access to the source of server-side ASP scripts, exposing embedded secrets, database credentials and application logic that can be reused for further attacks.
Attack surface
Reachable over the network via a crafted HTTP request to the web server; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no exploit tags appear in the references, but EPSS is high (0.648, 99.2nd percentile), suggesting substantial observed or expected exploitation activity.
What to do
- Apply the vendor fix referenced in Microsoft security bulletin MS98-003 and upgrade IIS to a supported, patched release.
- Retire or isolate any IIS/Windows NT host still running this vintage of software, since it is far past end of support.
- Block or normalize requests containing NTFS alternate data stream syntax such as "::$DATA" at the web server or WAF layer.
- Remove sensitive values from ASP source where possible and store secrets outside the web root.
- Restrict network exposure of legacy IIS servers to trusted clients only.
Detection
- Search web server access logs for requests containing "::$DATA" or other alternate data stream markers.
- Alert on HTTP responses returning ASP file contents with source markers such as "<%" instead of rendered HTML.
- Monitor for bulk or sequential requests to .asp paths from a single source, which may indicate source harvesting.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-1999-0278 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-1999-0278), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
