CVE-2000-0630

published 2000-07-17

CVE-2000-0630: IIS 4.0 and 5.0 allows remote attackers to obtain fragments of source code by appending a +.htr to the URL, a variant of the "File Fragment Reading via .HTR"…

Priority P4 28 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

EXPLOIT

IIS 4.0 and 5.0 allows remote attackers to obtain fragments of source code by appending a +.htr to the URL, a variant of the "File Fragment Reading via .HTR" vulnerability.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_information_server	—	—
microsoft	internet_information_services	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://victim/global.asa+.htr↗

path +.htr↗

process ISM.DLL↗

snort

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT .htr access"; flow:established,to_server; http.uri; content:".htr"; nocase; reference:bugtraq,1488; reference:cve,2000-0630; reference:nessus,10680; classtype:web-application-activity; sid:2100987; rev:18; metadata:created_at 2010_09_23, cve CVE_2000_0630, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

• → Detect HTTP requests where the URI contains the string '+.htr' (case-insensitive), targeting .asp, .asa, or .ini files — this is the exploit trigger pattern for CVE-2000-0630. ↗
• → The request is processed by ISM.DLL on the server side; presence of ISM.DLL handling .htr requests in IIS logs is indicative of exploitation attempts. ↗
• → Source disclosure stops at the first '<%%>' server-side script delimiter; pages using '<%%>' instead will disclose entire source or up to any '<%' — partial vs. full disclosure in responses can help confirm exploitation. ↗

• · This is a variant of a previously known vulnerability (BugTraq ID 1193); detections for the original .HTR File Fragment Reading bug should also be reviewed and may overlap. ↗
• · The Snort rule (sid:2100987) matches broadly on any URI containing '.htr' (nocase), which may produce false positives in environments with legitimate .htr file usage; tune accordingly.

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.