CVE-2002-1744

published 2002-12-31

CVE-2002-1744: Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary…

Priority P3 38 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

EXPLOIT

Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary files via a hex-encoded "%c0%ae%c0%ae" string, which is the Unicode representation for ".." (dot dot).

Affected

1 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_information_services	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://target/iissamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/default.asp↗

url http://target/IISSamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/%c0%ae%c0%ae/bogus_directory/nonexistent.asp↗

url http://target/IISSamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/%c0%ae%c0%ae/oracle/nonexistant.asp↗

path /IISSAMPLES/sdk/asp/docs/CodeBrws.asp↗

bytes↗

%c0%ae%c0%ae

• → Detect HTTP requests to CodeBrws.asp containing the Unicode-encoded traversal sequence '%c0%ae%c0%ae' in the Source query parameter, which represents '..' and enables directory traversal out of /IISSAMPLES. ↗
• → Monitor IIS logs for requests to /iissamples/sdk/asp/docs/CodeBrws.asp with a Source parameter containing '%c0%ae' sequences, indicating attempted source disclosure or directory enumeration. ↗

• · The vulnerable script CodeBrws.asp is only present when IIS 5.0 sample scripts (/IISSAMPLES) are installed. Systems without the sample scripts installed are not exposed to this vulnerability. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.