CVE-2000-0884
published 2000-12-19CVE-2000-0884: IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain…
PriorityP266high7.5CVSS 2.0
AVNACLAuNCPIPAP
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
70.55%
99.3th percentile
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_server | — | — |
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect Unicode-encoded directory traversal sequences in HTTP request URIs targeting IIS. Key encoded separators include %c0%af, %c1%9c, %c1%1c, %c0%9v, %c0%qf, %c1%8s, %c1%af, %c1%pc, %e0%80%af, %f0%80%80%af, %f8%80%80%80%af, %fc%80%80%80%80%af as substitutes for '/' or '\'. ↗
- →Alert on HTTP GET requests to IIS containing paths referencing winnt/system32/cmd.exe with ?/c+ query string, indicating attempted remote command execution via directory traversal. ↗
- →Monitor for the traversal scripts targeting known IIS virtual directories: /scripts/, /msadc/, /MSADC/, and /iisadmpwd/ combined with Unicode-encoded traversal sequences. ↗
- →Detect double-percent encoded traversal sequences (%255c, %252f, %252e) in HTTP URIs targeting IIS, which represent additional bypass variants for the same directory traversal vulnerability. ↗
- →Presence of root.exe or sensepost.exe in HTTP request paths on IIS servers indicates prior compromise or active exploitation (backdoor/webshell placement associated with Code Blue Worm activity). ↗
- →This vulnerability is associated with the Code Blue Worm; correlate IIS Unicode traversal exploitation attempts with worm propagation indicators. ↗
- ·Exploitation is unauthenticated and operates in the context of the IUSR_machinename account; any file accessible to the Everyone or Users groups on the same logical drive as a web-accessible file is at risk. ↗
- ·Windows 98 hosts running Microsoft Personal Web Server (PWS) are also vulnerable to this same Unicode directory traversal issue. ↗
- ·Exploit tooling supports SSL-proxied testing by routing through an SSLproxy on a specified port, meaning HTTPS-fronted IIS servers may also be testable/exploitable. ↗
- ·One exploit variant copies cmd.exe to an alternate filename before executing it, to evade simple filename-based blocking of cmd.exe. ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3gpv-hgg9-gfg5: IIS 4
ghsa_unreviewed·2022-04-30
CVE-2000-0884 [HIGH] GHSA-3gpv-hgg9-gfg5: IIS 4
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
VulnCheck
Microsoft IIS 4.0 and 5.0 Folder Traversal Vulnerability
vulncheck·2000·CVSS 7.5
CVE-2000-0884 [HIGH] Microsoft IIS 4.0 and 5.0 Folder Traversal Vulnerability
Microsoft IIS 4.0 and 5.0 Folder Traversal Vulnerability
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.
Affected: Microsoft Internet Information Services (IIS)
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.fortiguard.com/encyclopedia/ips/103022664
Suricata
GPL EXPLOIT unicode directory traversal attempt
suricata·2010-09-23
CVE-2000-0884 GPL EXPLOIT unicode directory traversal attempt
GPL EXPLOIT unicode directory traversal attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT unicode directory traversal attempt"; flow:established,to_server; http.uri.raw; content:"/..%c1%9c../"; reference:bugtraq,1806; reference:cve,2000-0884; reference:nessus,10537; classtype:web-application-attack; sid:2100983; rev:22; metadata:created_at 2010_09_23, cve CVE_2000_0884, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)
Suricata
GPL ATTACK_RESPONSE file copied ok
suricata·2010-09-23
CVE-2000-0884 GPL ATTACK_RESPONSE file copied ok
GPL ATTACK_RESPONSE file copied ok
Rule: alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"GPL ATTACK_RESPONSE file copied ok"; flow:established,to_client; file.data; content:"1 file|28|s|29| copied"; nocase; reference:bugtraq,1806; reference:cve,2000-0884; classtype:bad-unknown; sid:2100497; rev:15; metadata:created_at 2010_09_23, cve CVE_2000_0884, confidence Medium, signature_severity Informational, updated_at 2024_04_03;)
Suricata
GPL EXPLOIT unicode directory traversal attempt
suricata·2010-09-23
CVE-2000-0884 GPL EXPLOIT unicode directory traversal attempt
GPL EXPLOIT unicode directory traversal attempt
Rule: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"GPL EXPLOIT unicode directory traversal attempt"; flow:established,to_server; content:"/..%c1%1c../"; nocase; reference:bugtraq,1806; reference:cve,2000-0884; reference:nessus,10537; classtype:web-application-attack; sid:2100982; rev:14; metadata:created_at 2010_09_23, cve CVE_2000_0884, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)
Suricata
GPL EXPLOIT unicode directory traversal attempt
suricata·2010-09-23
CVE-2000-0884 GPL EXPLOIT unicode directory traversal attempt
GPL EXPLOIT unicode directory traversal attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT unicode directory traversal attempt"; flow:established,to_server; http.uri.raw; content:"/..%c0%af../"; nocase; reference:bugtraq,1806; reference:cve,2000-0884; reference:nessus,10537; classtype:web-application-attack; sid:2100981; rev:17; metadata:created_at 2010_09_23, cve CVE_2000_0884, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)
Exploit-DB
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (8)
exploitdb·2000-11-18
CVE-2000-0884 Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (8)
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (8)
---
#!/usr/bin/perl
#
# See http://www.securityfocus.com/vdb/bottom.html?section=exploit&vid=1806
#
# Very simple PERL script to execute commands on IIS Unicode vulnerable servers
# Use port number with SSLproxy for testing SSL sites
# Usage: unicodexecute2 IP:port command
# Only makes use of "Socket" library
#
# New in version2:
# Copy the cmd.exe to something else, and then use it.
# The script checks for this.
# Thnx to [email protected] for discovering the cmd.exe copy part
#
# Roelof Temmingh 2000/10/26
# [email protected] http://www.sensepost.com
use Socket;
# --------------init
if ($#ARGV){ push @in, $_;}
select(STDOUT); close(S); return @in;
} else { die("Can't connect...\n"); }
}
# Spidermark: sensep
Exploit-DB
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (7)
exploitdb·2000-11-18
CVE-2000-0884 Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (7)
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (7)
---
#!/usr/bin/perl
#
# IIS 4.0/5.0 Unicode Exploit
# Checks for each script that has been posted on the BugTraq Lis
# Shouts to bighawk(thats for help), datagram, Ghost Rider, The Duke, p4, kript0n and others
# Since It Uses fork(), you gotta keep up with whats happening. Or Just Let it run and it will
# log sites in the log_unicode.log.
# So Simple
# Use Socket
use Socket;
# incase no arguements or less arguements are given
if(@ARGV == '0' || @ARGV \n"; }
# Variables
$blah = $ARGV[0];
$port = 80;
$dir = $ARGV[1];
$timeout = 4;
# see if file is there,
if (-e "$blah") {
open(T, "$blah") || die "can't open $blah\n";
@target = ;
close(T);
}
else { @target[0] = $blah; } # what you think is blah
# all scripts ment
Exploit-DB
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (9)
exploitdb·2000-11-18
CVE-2000-0884 Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (9)
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (9)
---
/****************************************************************************\
** **
** Microsoft IIS 4.0/5.0 Extended UNICODE Directory Traversal Exploit **
** proof of theory exploit cuz it's wednesday and i'm on the couch **
** **
** brought to you by the letter B, the number 7, optyx, and t12 **
** optyx - **
** t12 - **
** **
** greetz go out to aempirei, a gun toatin' gangstah' hustler' player **
** motherfucker who isn't with us anymore, miah, who's GTA2 game was **
** was most entertaining tonight, Cathy, who provided the trippy light **
** to stare at, and to KT, for providing me with hours of decent **
** conversation. **
** **
\**************************************************************************
Exploit-DB
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (6)
exploitdb·2000-11-18
CVE-2000-0884 Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (6)
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (6)
---
/* iisex iis exploit (
*
* grtz to: Bio, nos, zoa, reg and vor... (who else would stay up
* at night to exploit this?) to securax (#securax@efnet) - also
* to kim, glyc, s0ph, tessa, lamagra and steven.
*/
#include
#include
#include
#include
#include
#include
#include
#include
int main(int argc, char **argv){
char buffy[666]; /* well, what else? I dunno how long your commands are.. */
char buf[500];
char rcvbuf[8192];
int i, sock, result;
struct sockaddr_in name;
struct hostent *hostinfo;
if (argc \n\n");
exit(0);
}
printf ("\niisex - iis 4 and 5 exploit\n---------------------------\n");
printf ("act like a cmd.exe kiddie, type quit to quit.\n");
for (;;)
{
printf ("\n[enter cmd> ");
gets(buf);
if (strstr(buf,
Exploit-DB
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (2)
exploitdb·2000-10-21
CVE-2000-0884 Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (2)
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (2)
---
source: https://www.securityfocus.com/bid/1806/info
Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot "../" directory traversal exploitation if extended UNICODE character representations are used in substitution for "/" and "\".
Unauthenticated users may access any known file in the context of the IUSR_machinename account. The IUSR_machinename account is a member of the Everyone and Users groups by default, therefore, any file on the same logical drive as any web-accessible file that is accessible to these groups can be deleted, modified, or executed. Successful exploitation would yield the same privileges as a user who could successfully log onto the system to a remote user possessing no credentials
Exploit-DB
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (4)
exploitdb·2000-10-17
CVE-2000-0884 Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (4)
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (4)
---
source: https://www.securityfocus.com/bid/1806/info
Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot "../" directory traversal exploitation if extended UNICODE character representations are used in substitution for "/" and "\".
Unauthenticated users may access any known file in the context of the IUSR_machinename account. The IUSR_machinename account is a member of the Everyone and Users groups by default, therefore, any file on the same logical drive as any web-accessible file that is accessible to these groups can be deleted, modified, or executed. Successful exploitation would yield the same privileges as a user who could successfully log onto the system to a remote user possessing no credentials
Exploit-DB
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (3)
exploitdb·2000-10-17
CVE-2000-0884 Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (3)
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (3)
---
// source: https://www.securityfocus.com/bid/1806/info
Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot "../" directory traversal exploitation if extended UNICODE character representations are used in substitution for "/" and "\".
Unauthenticated users may access any known file in the context of the IUSR_machinename account. The IUSR_machinename account is a member of the Everyone and Users groups by default, therefore, any file on the same logical drive as any web-accessible file that is accessible to these groups can be deleted, modified, or executed. Successful exploitation would yield the same privileges as a user who could successfully log onto the system to a remote user possessing no credenti
Exploit-DB
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (5)
exploitdb·2000-10-17
CVE-2000-0884 Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (5)
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (5)
---
source: https://www.securityfocus.com/bid/1806/info
Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot "../" directory traversal exploitation if extended UNICODE character representations are used in substitution for "/" and "\".
Unauthenticated users may access any known file in the context of the IUSR_machinename account. The IUSR_machinename account is a member of the Everyone and Users groups by default, therefore, any file on the same logical drive as any web-accessible file that is accessible to these groups can be deleted, modified, or executed. Successful exploitation would yield the same privileges as a user who could successfully log onto the system to a remote user possessing no credentials
Exploit-DB
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (1)
exploitdb·2000-10-17
CVE-2000-0884 Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (1)
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (1)
---
// source: https://www.securityfocus.com/bid/1806/info
Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot "../" directory traversal exploitation if extended UNICODE character representations are used in substitution for "/" and "\".
Unauthenticated users may access any known file in the context of the IUSR_machinename account. The IUSR_machinename account is a member of the Everyone and Users groups by default, therefore, any file on the same logical drive as any web-accessible file that is accessible to these groups can be deleted, modified, or executed. Successful exploitation would yield the same privileges as a user who could successfully log onto the system to a remote user possessing no credenti
arXiv
Uplifted Attackers, Human Defenders: The Cyber Offense-Defense Balance for Trailing-Edge Organizations
arxiv_fulltext·2025-08-14
Uplifted Attackers, Human Defenders: The Cyber Offense-Defense Balance for Trailing-Edge Organizations
-30pt
footnote0
## Abstract
Advances in artificial intelligence are widely understood to have implications for cybersecurity. Articles have emphasized the effect of AI on the cyber offense-defense balance, and credible commentators can be found arguing either that cyber will privilege attackers or defenders. For defenders, arguments are often made that AI will enable solutions like formal verification of all software—and for some well-equipped companies, this may be true. This conversation, however, does not match the reality for most companies. ``Trailing-edge organizations,'' as we term them, rely heavily on legacy software, poorly staff security roles, and struggle to implement best practices like rapid deployment of security patches. These decisions may be the result of corporate ine
arXiv
Encoding a Taxonomy of Web Attacks with Different-Length Vectors
arxiv_fulltext·2002-10-29
Encoding a Taxonomy of Web Attacks with Different-Length Vectors
## Abstract
Web attacks, i.e. attacks exclusively using the HTTP protocol, are
rapidly becoming one of the fundamental threats for information
systems connected to the Internet. When the attacks suffered by
web servers through the years are analyzed, it is observed that
most of them are very similar, using a reduced number of attacking
techniques. It is generally agreed that classification can help
designers and programmers to better understand attacks and build
more secure applications. As an effort in this direction, a new
taxonomy of web attacks is proposed in this paper, with the
objective of obtaining a practically useful reference framework
for security applications. The use of the taxonomy is illustrated
by means of multiplatform real world web attack examples. Along
with this taxo
CAPEC
Using UTF-8 Encoding to Bypass Validation Logic
mitre_capec
[HIGH] Using UTF-8 Encoding to Bypass Validation Logic
CAPEC-80: Using UTF-8 Encoding to Bypass Validation Logic
This attack is a specific variation on leveraging alternate encodings to bypass validation logic. This attack leverages the possibility to encode potentially harmful input in UTF-8 and submit it to applications not expecting or effective at validating this encoding standard making input filtering difficult. UTF-8 (8-bit UCS/Unicode Transformation Format) is a variable-length character encoding for Unicode. Legal UTF-8 characters are one to four bytes long. However, early version of the UTF-8 specification got some entries wrong (in some cases it permitted overlong characters). UTF-8 encoders are supposed to use the "shortest possible" encoding, but naive decoders may accept encodings that are longer than necessary. According to the
CAPEC
Using Unicode Encoding to Bypass Validation Logic
mitre_capec
[HIGH] Using Unicode Encoding to Bypass Validation Logic
CAPEC-71: Using Unicode Encoding to Bypass Validation Logic
An attacker may provide a Unicode string to a system component that is not Unicode aware and use that to circumvent the filter or cause the classifying mechanism to fail to properly understanding the request. That may allow the attacker to slip malicious data past the content filter and/or possibly cause the application to route the request incorrectly.
Execution Flow:
Step 1 [Explore]: [Survey the application for user-controllable inputs] Using a browser or an automated tool, an attacker follows all public links and actions on a web site. They record all the links, the forms, the resources accessed and all other potential entry-points for the web application.
Technique: Use a spidering tool to follow and record all links and an
CWE
Improper Handling of Unicode Encoding
mitre_cwe
CWE-176 Improper Handling of Unicode Encoding
CWE-176: Improper Handling of Unicode Encoding
The product does not properly handle when an input contains Unicode encoding.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity. Impact: Unexpected State.
Potential Mitigations:
[Architecture and Design] Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input,
http://www.osvdb.org/436http://www.securityfocus.com/bid/1806https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-078https://exchange.xforce.ibmcloud.com/vulnerabilities/5377https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A44http://www.osvdb.org/436http://www.securityfocus.com/bid/1806https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-078https://exchange.xforce.ibmcloud.com/vulnerabilities/5377https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A44
2000-12-19
Published
Exploited in the wild