cbcvebase.
CVE-2007-0042
published 2007-07-10

CVE-2007-0042: Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access…

PriorityP357high7.8CVSS 2.0
AVNACLAuNCCINAN
EXPLOIT
EPSS
77.72%
99.5th percentile
Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files and obtain sensitive information, and possibly bypass security mechanisms that try to constrain the final substring of a string, via %00 characters, related to use of %00 as a string terminator within POSIX functions but a data character within .NET strings, aka "Null Byte Termination Vulnerability."

Affected

3 ranges
VendorProductVersion rangeFixed in
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://www.example.com/[path]/somescript.asp%00↗
  • →Detect HTTP requests containing null byte (%00) sequences in the URL path, particularly appended to file extensions (e.g., .asp%00, .aspx%00), which may indicate an attempt to exploit null byte termination to access restricted configuration files. ↗
  • →Monitor for requests to ASP.NET applications where the URL contains %00 (null byte), as attackers use this to bypass security mechanisms that constrain the final substring of a string. ↗
  • →Alert on HTTP requests targeting configuration files (e.g., web.config) via null byte injection in ASP.NET applications, which may expose sensitive information. ↗
  • ·The vulnerability affects Microsoft .NET Framework versions 1.0, 1.1, and 2.0 on Windows 2000, XP, Server 2003, and Vista. Detection rules should be scoped to these platform/version combinations to reduce false positives. ↗
  • ·The null byte (%00) behaves as a string terminator in POSIX functions but as a data character in .NET strings — detection logic must account for URL-encoded (%00) and raw null byte forms in HTTP traffic. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.