cbcvebase.
CVE-2004-1166
published 2004-12-31

CVE-2004-1166: CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp://…

PriorityP345high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
39.16%
98.4th percentile
CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline ("%0a") before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command.

Affected

4 ranges
VendorProductVersion rangeFixed in
microsoftie——
microsoftinternet_explorer——
microsoftinternet_explorer——
microsoftinternet_explorer——

Detection & IOCsextracted from sources · hover to see the quote

urlftp://ftp.example.com/%0aPORT%20a,b,c,d,e,f%0aRETR%20/file↗
command%0aPORT%20a,b,c,d,e,f%0aRETR%20/file↗
command%0d%0aRCPT%20TO%3a%0d%0aDATA%0d%0aSubject%3a%20hacked%0d%0aTo%3a%20username%40example.com%0d%0a%0d%0ahacked%0d%0a.%0d%0a↗
  • →Detect URL-encoded CRLF sequences (%0a or %0d%0a) within ftp:// URIs processed by Internet Explorer, which indicate injected FTP commands. ↗
  • →Monitor FTP sessions initiated by Internet Explorer for unexpected PORT or RETR commands not initiated by the user, which may indicate CRLF-injected command execution. ↗
  • →Inspect HTML pages for <img> tags or hyperlinks embedding ftp:// URIs containing %0a or %0d%0a sequences followed by SMTP-like commands (RCPT TO, DATA), which can be used to send email without user interaction. ↗
  • →Alert on outbound connections to port 25 (SMTP) originating from an FTP URI context in Internet Explorer, as the vulnerability can be chained to relay email via CRLF injection. ↗
  • ·Affected versions are Internet Explorer 6.0.2800.1106 and earlier (including 5.0.1); the CRLF injection occurs due to failure to sanitize user-supplied URI input before passing it to FTP sessions. ↗
  • ·The exploit payload uses URL-encoded representations of both LF (%0a) and CRLF (%0d%0a); detection rules should account for both variants in ftp:// URI strings. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.