CVE-2002-0422: IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a…

PriorityP424low2.6CVSS 2.0

AVNACHAuNCPINAN

EXPLOIT

EPSS

42.25%

98.5th percentile

IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response, or (2) via the WRITE or MKCOL method, which leaks the IP in the Location server header.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_information_services	—	—

Detection & IOCsextracted from sources · hover to see the quote

commandPROPFIND (HTTP method with blank Host header)↗

commandWRITE (WebDAV HTTP method)↗

commandMKCOL (WebDAV HTTP method)↗

→Detect inbound HTTP PROPFIND requests with a blank or missing Host header targeting IIS 5/5.1 servers; a 207 Multi-Status response containing an internal IP in an HREF property indicates successful exploitation. ↗
→Detect inbound HTTP WRITE or MKCOL WebDAV method requests; a Location response header containing an RFC-1918 (internal) IP address indicates the server is leaking its internal IP. ↗
→Monitor for automated scanning of WebDAV-enabled IIS servers for internal IP disclosure using tools such as the Metasploit auxiliary module webdav_internal_ip. ↗
→Also monitor for PROPFIND-based internal IP leakage on newer IIS versions (7+) when alternateHostName is not set or misconfigured, as the same disclosure vector applies beyond IIS 5/5.1. ↗

·The vulnerability affects IIS 5 and 5.1 specifically when WebDAV methods are enabled; disabling WebDAV eliminates the attack surface for this CVE. ↗
·On IIS 7+ the internal IP disclosure via PROPFIND can still occur if the alternateHostName is not set or is misconfigured, meaning the issue is not strictly limited to legacy IIS versions. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.