CVE-2000-0886

published 2000-12-19

CVE-2000-0886: IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system…

Priority P3 47 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_information_server	—	—
microsoft	internet_information_services	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://target/scripts/file.bat"+&+dir+c:/+.exe↗

url http://target/scripts/file.bat"+&+dir+c:/+.com↗

url http://target/scripts/a.bat"+".exe?+&+dir↗

url http://target/scripts/..%c1%1c../..%c1%1c../mssql7/install/pubtext.bat"+&+dir+c:\+.exe↗

url http://target/scripts/file.bat/..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c%20dir%20C:↗

url http://target/scripts/georgi.asp/..%C1%9C..%C1%9C..%C1%9Cfile.ext↗

path /scripts/↗

snort

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT .cmd executable file parsing attack"; flow:established,to_server; http.uri; content:".cmd|22|"; nocase; pcre:"/^.*?\x26/Ri"; reference:bugtraq,1912; reference:cve,2000-0886; classtype:web-application-attack; sid:2103193; rev:6; metadata:created_at 2010_09_23, cve CVE_2000_0886, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_22;)

• → Look for HTTP requests to .bat or .cmd files in /scripts/ that contain a double-quote character (") immediately following the filename, which is the delimiter used to inject OS commands. ↗
• → Detect the byte sequence `.cmd` followed immediately by a double-quote (0x22) in the HTTP URI, combined with an ampersand (&, 0x26) anywhere later in the URI — as captured by the Snort rule content `.cmd|22|` and pcre `/^.*?\x26/Ri`.
• → After patch Q277873, watch for path traversal sequences using overlong/alternate UTF-8 encoding (%C1%9C) appended to .bat or .asp file requests, followed by a path to cmd.exe. ↗
• → Monitor for process creation of cmd.exe spawned under the IIS worker process (inetinfo.exe or w3wp.exe) running as IUSR_machinename, which indicates successful exploitation. ↗
• → An active worm exploiting this vulnerability has been reported; correlate high-volume identical malformed .bat/.cmd requests across multiple source IPs as a worm propagation indicator. ↗

• · Exploitation requires the target .bat or .cmd file to already exist on the server AND the requesting user must have execute permissions on that folder; requests to non-existent scripts will fail. ↗
• · Microsoft's patch Q277873 does not fully remediate the vulnerability; Georgi Guninski discovered post-patch variants using %C1%9C-encoded path traversal that still allow command execution. ↗
• · The attack surface extends beyond cmd.exe to ActiveState Perl installations on the same IIS server, meaning Perl-based command parsing is also exploitable. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.