CVE-2007-0042: ASP.NET Null Byte Termination Flaw Exposes Configuration Files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe flaw allows unauthenticated remote information disclosure of configuration files, and EPSS is at the 99.5th percentile, though no KEV listing or confirmed in-the-wild exploitation is documented.

What it is

ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 mishandles %00 characters because POSIX functions treat them as string terminators while .NET strings treat them as data. This interpretation conflict lets remote attackers read configuration files and obtain sensitive information, and may bypass security checks that constrain the final substring of a string.

Impact

An attacker can retrieve sensitive configuration files and other protected content, exposing credentials, connection strings, and application secrets. The flaw may also defeat input-validation or path-restriction logic that relies on substring checks.

Attack surface

Reachable remotely over the network against ASP.NET applications, with no authentication or user interaction required per the CVSS vector AV:N/AC:L/Au:N. The attacker supplies crafted input containing %00 characters to a request handled by the affected framework.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.76151 (99.5th percentile), indicating substantial predicted exploitation activity. References are vendor and government advisories plus a third-party advisory, with no public exploit tag supplied.

What to do

• Apply Microsoft security bulletin MS07-040 for .NET Framework 1.0, 1.1, and 2.0 on affected Windows versions.
• Upgrade applications off the unsupported .NET Framework 1.0/1.1/2.0 runtimes to a currently supported release.
• Reject or normalize %00 and other encoded null bytes in all request input at the web server and application layer.
• Do not rely on substring or suffix checks for path and file access control; validate canonicalized paths against an allowlist.
• Restrict filesystem permissions so web application processes cannot read configuration files outside their required scope.

Detection

• Search web server and application logs for requests containing %00, %2500, or raw null bytes in URLs, query strings, or form fields.
• Alert on access to web.config, machine.config, or other configuration file paths from external clients.
• Monitor for anomalous reads of configuration or sensitive files by the ASP.NET worker process.
• Review WAF and proxy logs for encoded null byte patterns that bypass path or extension filtering.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.