CVE-2000-0413

published 2000-05-06

CVE-2000-0413: The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and…

Priority P4 16 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

EXPLOIT

The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by requesting a file that does not exist, which generates an error message that reveals the path.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_information_server	—	—
microsoft	internet_information_services	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /_vti_bin/shtml.exe↗

path /_vti_bin/shtml.dll↗

filename shtml.exe↗

filename shtml.dll↗

• → Detect HTTP requests targeting /_vti_bin/shtml.exe or /_vti_bin/shtml.dll with arbitrary file extensions (.html, .htm, .shtml, .asp) appended to the path — a non-existent file triggers a full physical path disclosure in the error response. ↗
• → Inspect HTTP responses for the error string pattern 'Cannot open "C:\' which indicates a successful path disclosure from shtml.exe/shtml.dll. ↗
• → Monitor for requests to /_vti_bin/ path prefix on IIS servers, particularly those appending file paths with extensions .html, .htm, .shtml, or .asp after shtml.exe or shtml.dll. ↗

• · The vulnerability affects both shtml.exe (Windows/IIS) and shtml.dll depending on the platform; detection rules should cover both filenames. ↗
• · Affected versions are IIS 4.0 and 5.0 with FrontPage Server Extensions 1.1 and prior; detections can be scoped to these legacy platforms. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.