CVE-2000-0097

published 2000-01-26

CVE-2000-0097: The WebHits ISAPI filter in Microsoft Index Server allows remote attackers to read arbitrary files, aka the "Malformed Hit-Highlighting Argument" vulnerability.

Priority P4 30 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

EXPLOIT

The WebHits ISAPI filter in Microsoft Index Server allows remote attackers to read arbitrary files, aka the "Malformed Hit-Highlighting Argument" vulnerability.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
microsoft	index_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /webhits.dll↗

filename webhits.dll↗

command GET %s%20...%20.htw?CiWebHitsFile=%s&CiRestriction=none&CiHiliteType=Full HTTP/1.0↗

path ../../../../boot.ini↗

• → Detect HTTP GET requests targeting .htw files containing directory traversal sequences (../) in the CiWebHitsFile query parameter, which is the exploitation vector for this vulnerability. ↗
• → Alert on HTTP requests containing the query parameters CiWebHitsFile, CiRestriction, and CiHiliteType targeting .htw endpoints, as these are the specific parameters used in hit-highlighting exploitation. ↗
• → Monitor for unauthenticated requests to webhits.dll or .htw files from external/untrusted sources, particularly those referencing sensitive files such as boot.ini or include files. ↗
• → The exploit pads the valid file path with %20 (URL-encoded spaces) before appending .htw to bypass path validation; detect anomalous sequences of %20 in GET request URIs targeting .htw resources. ↗
• → Even after patching, 'include' file types remain disclosed; monitor for CiWebHitsFile values referencing include file extensions as a sign of post-patch exploitation attempts. ↗

• · The original patch for CVE-2000-0097 is incomplete and does not fully remediate the vulnerability — 'include' file types remain readable after patching, meaning patched systems may still be partially exploitable. ↗
• · This vulnerability affects both Index Server 2.0 (NT 4.0 Option Pack) and the built-in Indexing Services in Windows 2000 when combined with IIS; both deployment configurations are at risk. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.