Office Web Apps Server 2013 March 2017 Update


  • We installed KB 3172457 last week on our production Office Web Apps Server 2013 farms (paired with SharePoint Server 2013) . Since then, opening Office Web Apps files on SharePoint webs with spaces (%20) in the URL throws the generic "Sorry, there was a problem..." error in the browser and this error in ULS:

    System.Web.HttpException: A potentially dangerous Request.Path value was detected from the client (%).   
     at System.Web.HttpRequest.ValidateInputIfRequiredByConfig()    
     at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context) 

    Webs without spaces in the URL do not exhibit the problem. Spaces in the library or filename do not have an effect. Office files can be downloaded from SharePoint and opened/edited in the desktop client. This issue is easily reproducible.

    Any help or comments would be much appreciated. We have a support ticket pending, but we figure we can't be the only ones having this issue.


    • Edited by TsunamiStevo Tuesday, March 28, 2017 4:16 PM inclusion of browser error
    Tuesday, March 28, 2017 4:04 PM


All replies

  • First glance, this seems like a CU issue.  It's come up before (quick search on the error text returns many hits) and other admins have reported on it.  While waiting on the MS support to get back to you, you may want to try these things out:

    Please update this posting as you work on it with MS Support.

    Tuesday, March 28, 2017 4:59 PM
  • Stephen,

    Thank you for your time. We had already tried rebuilding the OWA farm at the time of the original post (I should have mentioned it). It had no effect. Can you please share your thoughts on how a full crawl might help?

    Incidentally, we haven't installed a CU since July 2016 (although we do patch monthly). We prefer to only install individual important and security updates unless there is a compelling reason to install a CU.

    The documentation for this update indicates that a problem much like what we're seeing was supposedly fixed by this update. Interestingly, the update seems to have CAUSED the issue in our environment.


    • Edited by TsunamiStevo Tuesday, March 28, 2017 5:28 PM additional detail
    Tuesday, March 28, 2017 5:09 PM
  • By doing a full crawl, you're refreshing the crawled URL data.  I've had to do this sometimes after working on OWA server and discovering that the popups that usually display in the search results were not displaying correctly - performing a full crawl fixed this.  On the other hand, if you have alot of content, such a test might not be convenient or feasible, depending on your service hours.

    Unfortunately, the images you provided are not legible.  If you can, edit your posting that includes the images, hacking the HTML so that the current image is a hotlink to the full image.

    Tuesday, March 28, 2017 8:52 PM
  • The error is occurring independent from search. We can navigate directly to an affected library and recreate the issue. I went ahead and removed the images from my earlier post as they did not lend much clarity even if they were visible.


    Tuesday, March 28, 2017 9:26 PM
  • And add this to the Mix!

    These two were accidentally installed on one of our front End servers:

    After that, any Web App request would fail that went to that Front-End server - only ones with Sub-Sites with spaces in the names.   (I will have to check more to see if I can reproduce with new libraries / sites)

    ULS Logs show:  "Failure when fetching document"

    0x80070092   -

    Could it mean that these "security updates" must be installed on ALL the servers + the new patches for the Web Apps server before everything works right?

    Steve Hahn

    Thursday, March 30, 2017 6:42 PM
  • Our support engineer acknowledged that other customers are having issues with Office Web Apps when the web has spaces in the URL after installing KB3172540.


    Thursday, March 30, 2017 7:19 PM
  • Steven

    You may be doing this already, but just to be sure: you should always patch servers so that all SharePoint farm servers are at the same patch level (and thus at the same build level). It doesn't matter if the patch is a CU, PU or hotfix.  If you don't, these differences will eventually be noticed by your farm and will prevent running PSCONFIG.  The TechNet article, Install a software update (SharePoint 2013), discusses this more.  A great article I recommend reading about patching is Stefan Gosssner's SharePoint patching demystified.  

    Thursday, March 30, 2017 9:23 PM
  • Hence the:

    "These two were accidentally installed on one of our front End servers"

    And the part where we are restoring because it was a mistake.  No SharePoint updates were supposed to be applied on any SharePoint server.    Especially before they were tested in DEV first.

    But it is interesting that the same problem occurred by just installing the one patch.   I even tested this and noticed that it worked as long as I took out the spaces in the sub site's names.

    I'd love to know if people are installing the March CU but not upgrading their Web App servers and running into the same issue before I test.

    Steve Hahn

    Thursday, March 30, 2017 9:36 PM
  • Any resolution to this? We're experiencing the same issue. Thanks.
    Tuesday, April 4, 2017 7:31 PM
  • If you are experiencing this issue, please contact Microsoft support. I have this update from a Sr. Escalation Engineer on the SharePoint team:

    "I want to provide a quick update on this issue and want to apologize upfront if this update appears less personal than typical case updates. We have a number of customers that are experiencing issues with using Office Web Applications and/or Excel Web Services after applying any of the following updates:

    * KB3172540 MS17-014: Description of the security update for SharePoint Foundation 2013: March 14, 2017
    * KB3172431 MS17-014: Description of the security update for Excel Services on SharePoint Server 2013: March 14, 2017
    * SharePoint Server 2013 March 2017 Cummulative Update

    After applying, documents can no longer be opened via Office Web Apps or Excel Web Services if the site URL contains a space (document names with spaces are ok).

    The product group has identified a solution to the regression introduced in those updates, and a fix to the issue which the original change was intending to resolve. We are working toward getting a private fix that will address this issue for you but there are processes we need to follow to limit further chance of regression in the components affected. As much as we would like to have this issue resolved yesterday, it is not as simple as building a fix with the previous change removed and providing untested, raw binaries. I do not have an ETA on availability at this time however we have appropriate teams engaged."


    Thursday, April 6, 2017 6:21 PM
  • Thanks for this update; i know it's only 6 days later, but has a patch been created? I have a customer that is in dire need of this update.  The Windows Update patching routine is what got it applied to their production servers and they did NOT mean for this to happen.  I would love to suggest that Microsoft stop distrubuting patches through Windows Update for critical components like Sharepoint and Project Server.  Should we call support and get on a thread to receive this private update? Thanks!
    Wednesday, April 12, 2017 7:30 PM
  • This update contains the fix for the issue:

    We have tested it in acceptance and it appears to have worked. We are able to open Office Web Apps files with spaces in the site/web URL and we don't see any further regressions.


    • Edited by TsunamiStevo Monday, April 17, 2017 1:16 PM added hyperlink
    • Marked as answer by TsunamiStevo Monday, April 17, 2017 1:18 PM
    Monday, April 17, 2017 1:16 PM
  • Hi,

    I get this same issue with Web Apps not rendering with only the Chrome 57 Update. Do any of you guys experience this and if you know if the April CU will fix this issue? or this entirely unrelated.

    Thanks in advance


    Monday, April 17, 2017 6:00 PM
  • The problems discussed in this post are related exclusively to KB3172540 and KB3172431. Installing those updates on your farm could have caused sites or webs with spaces (%20) in the URL to not open Office Web Apps files in the browser properly. The behavior was farm-wide and to my knowledge, was browser-agnostic (meaning that it didn't matter what browser you're using; the error would always happen).


    Wednesday, April 19, 2017 1:24 PM