CVE-2000-0457

published 2000-05-11

CVE-2000-0457: ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and…

Priority P3 34 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and terminated with a .htr extension, aka the ".HTR File Fragment Reading" or "File Fragment Reading via .HTR" vulnerability.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_information_server	—	—
microsoft	internet_information_services	—	—

Detection & IOCs extracted from sources · hover to see the quote

path ISM.DLL↗

url http://target/filename%20(repeated approx 230 times).htr↗

• → Detect HTTP requests targeting IIS where the URL contains a long sequence of '%20' encoded spaces (~230 occurrences) and terminates with a '.htr' extension — this is the canonical exploit pattern for CVE-2000-0457. ↗
• → Monitor for ISAPI handler invocations of ISM.DLL triggered by .htr extension requests, particularly on first load or after a web server restart, as the exploit only works when ISM.DLL is freshly loaded into memory. ↗
• → Alert on HTTP requests where the URI ends in '.htr' and contains an unusually large number of '%20' tokens (threshold: ~230), which indicates an attempt to exploit the File Fragment Reading via .HTR vulnerability. ↗

• · The exploit is only effective when ISM.DLL is being loaded into memory for the first time (i.e., no prior .htr request in the current server session). A web server restart resets this condition, meaning repeated exploitation attempts within the same session will fail. ↗
• · The vulnerability is rooted in the .htr extension being mapped to the ISM.DLL ISAPI application. Removing or unmapping this ISAPI extension mapping in IIS would eliminate the attack surface. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.