CVE-2007-2815: The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration…

PriorityP262critical10CVSS 2.0

AVNACLAuNCCICAC

EXPLOIT

EPSS

71.91%

99.4th percentile

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_information_services	—	—

Detection & IOCsextracted from sources · hover to see the quote

filenamewebhits.dll↗

path/shao/null.htw↗

url/null.htw?CiWebhitsfile=<target>&CiRestriction=b&CiHiliteType=full↗

filenamenull.htw↗

→Detect HTTP requests targeting null.htw with the CiWebhitsfile query parameter, which is the core exploitation vector for authentication bypass. ↗
→Look for query strings containing both 'CiWebhitsfile' and 'CiHiliteType=full' in IIS access logs, as these are the specific parameters used in the exploit. ↗
→Monitor IIS logs for requests to *.htw resources (hit-highlighting handler) from unauthenticated or unexpected sources, especially when combined with CiWebhitsfile pointing to protected directories. ↗

·The bypass only works because webhits.dll relies solely on Windows NT ACL configuration rather than enforcing NTLM or Basic authentication, meaning the vulnerability is architectural to the IIS 5.0 hit-highlighting feature. ↗
·The exploit targets IIS 5.1 specifically; confirm the affected version scope before applying detection rules to other IIS versions. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.