title: How to fix aspx?Dir=http://externalwebsite.com IIS 8.5 vulnerability
body: <p>I work with developing and pre-production IIS servers to publish and test the web applications we develop. Some Ethical Hacking consultant came and warned us about a vulnerability they found in some of our servers:</p>
  
  <p><a href="http://www.ourserver.com/default_logged.aspx?Dir=http://www.anyexternalsite.com" rel="nofollow noreferrer">http://www.ourserver.com/default_logged.aspx?Dir=http://www.anyexternalsite.com</a></p>
  
  <p>This vulnerability redirects the user from our website to an external website, letting them exposed to be phishing victims.</p>
  
  <p>I googled about this vulnerability (directory or path traversal) and I found this link:</p>
  
  <p><a href="https://www.cvedetails.com/cve/CVE-2014-4078/" rel="nofollow noreferrer">https://www.cvedetails.com/cve/CVE-2014-4078/</a></p>
  
  <p>I followed their advise to install some updates from this official MS site (for Windows Server 2012 R2):</p>
  
  <p><a href="https://technet.microsoft.com/library/security/ms14-076" rel="nofollow noreferrer">https://technet.microsoft.com/library/security/ms14-076</a></p>
  
  <p>But the issue stills there... if anyone knows about it and tell me how to solve it, I will appreciate it very much.</p>
  
  <p>Thanks in advance.</p>