CVE-2003-1567
published 2009-01-15CVE-2003-1567: The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
25.06%
97.7th percentile
The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism, by using TRACK to read the contents of the HTTP headers that are returned in the response, a technique that is similar to cross-site tracing (XST) using HTTP TRACE.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP TRACK method requests in web server logs or network traffic; presence of TRACK method requests targeting IIS 5.0 or Cisco ECDS is indicative of CVE-2003-1567 exploitation attempts. ↗
- →Monitor for HTTP responses that echo back the original request headers in the response body, which is the characteristic behavior of the TRACK method being enabled and exploited. ↗
- →Alert on TRACK method usage as a cross-site tracing (XST) vector; this technique mirrors HTTP TRACE abuse and can be used to exfiltrate HttpOnly cookies from response headers. ↗
- ·The TRACK method is undocumented in IIS 5.0, meaning it may not appear in standard HTTP method allowlists and could be overlooked by WAF/firewall rules that only block TRACE. ↗
- ·HttpOnly cookie protections can be bypassed via this vulnerability, meaning relying solely on HttpOnly flags is insufficient mitigation when TRACK is enabled on the server. ↗
- ·The vulnerability affects Cisco ECDS in addition to IIS 5.0; defenders should ensure TRACK method blocking is applied to all affected platforms, not just Microsoft IIS. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vendor_cisco5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Enterprise Content Delivery System Manager HTTP TRACK Vulnerability
vendor_cisco·2014-08-07·CVSS 5.8
CVE-2003-1567 [MEDIUM] CWE-200 Cisco Enterprise Content Delivery System Manager HTTP TRACK Vulnerability
Cisco Enterprise Content Delivery System Manager HTTP TRACK Vulnerability
A vulnerability in the HTTP TRACK/TRACE method of the Cisco Enterprise Content Delivery System (ECDS) could allow an unauthenticated, remote attacker read access to some information stored in the affected system.
The vulnerability is due to an affected web server. An attacker could exploit this vulnerability by using TRACK to read the content of the HTTP headers that are returned in the response.
Cisco has confirmed the vulnerability in a security notice and released software updates.
A successful exploit could allow an attacker to gain read access to sensitive information stored on a targeted system. The information could allow the attacker to conduct further attacks.
GHSA
GHSA-52vj-29px-76m7: The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5
ghsa_unreviewed·2022-04-29
CVE-2003-1567 [MEDIUM] CWE-200 GHSA-52vj-29px-76m7: The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5
The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism, by using TRACK to read the contents of the HTTP headers that are returned in the response, a technique that is similar to cross-site tracing (XST) using HTTP TRACE.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0321.htmlhttp://www.aqtronix.com/Advisories/AQ-2003-02.txthttp://www.kb.cert.org/vuls/id/288308http://www.osvdb.org/5648http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0321.htmlhttp://www.aqtronix.com/Advisories/AQ-2003-02.txthttp://www.kb.cert.org/vuls/id/288308http://www.osvdb.org/5648https://www.aqtronix.com/Advisories/AQ-2003-02.txt
2009-01-15
Published