Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have our website on an IIS shared hosting server. While working on a file monitor for our site, we have found that the File System Object allows us to enumerate the directories and files of other customers that are on the same server as us. Attempting to enumerate files in some root customer directories results in access denied errors - but not all.

Is this an IIS configuration error? A Windows configuration error?

How can we direct our hosting company to fix the problem?

share|improve this question
    
Under what user context can you enumerate the files and directories? Under what user context do the web sites/application pools run? –  joeqwerty Sep 21 '12 at 1:59
    
@joeqwerty Any anonymous web site visitor hitting a particular test script that instantiates a Scripting.FileSystemObject can enumerate the files and directories. We don't know what user context the site/pools run in. –  sean e Sep 21 '12 at 2:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.