CVE-2009-1122
published 2009-06-10CVE-2009-1122: The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to…
PriorityP273high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
98.45%
99.9th percentile
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_services | — | — |
| microsoft | internet_information_services | — | — |
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP requests to IIS WebDAV endpoints containing the overlong UTF-8 sequence %c0%af (Unicode slash) anywhere in the URI path, which is used to bypass authentication on protected folders. ↗
- →The vulnerability is exploitable where WebDAV is enabled on IIS 6.0 and protected folders require Basic, Digest, or NTLM authentication — scope detection to IIS 6.0 servers with WebDAV active. ↗
- ·This CVE (CVE-2009-1122) is noted as a distinct but related vulnerability to CVE-2009-1535; both involve %c0%af Unicode bypass on IIS WebDAV but are separate issues — ensure detection rules target both CVEs independently. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f2c7-qmx6-wq66: The WebDAV extension in Microsoft Internet Information Services (IIS) 5
ghsa_unreviewed·2022-05-02·CVSS 7.5
CVE-2009-1535 [HIGH] CWE-287 GHSA-f2c7-qmx6-wq66: The WebDAV extension in Microsoft Internet Information Services (IIS) 5
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122.
GHSA
GHSA-c9gf-r7p8-qf28: The WebDAV extension in Microsoft Internet Information Services (IIS) 5
ghsa_unreviewed·2022-05-02·CVSS 7.5
CVE-2009-1122 [HIGH] CWE-287 GHSA-c9gf-r7p8-qf28: The WebDAV extension in Microsoft Internet Information Services (IIS) 5
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.
No detection rules found.
Exploit-DB
Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2)
exploitdb·2009-05-26
CVE-2009-1122 Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2)
Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2)
---
#!/usr/bin/perl -W
#
# Microsoft IIS 6.0 WebDAV Remote Authentication Bypass Exploit
# written by ka0x
# Advisory: http://www.milw0rm.com/exploits/8765
#
# Greets: an0de, Piker, xarnuz, NullWave07, Pepelux, k0rde, JoSs, Trancek and others!
use IO::Socket ;
my ( $host, $path ) = @ARGV ;
my $port = 80 ; # webserver port
&usage unless $ARGV[1] ;
$host =~ s/http:\/\/// if($host =~ /^http:\/\//i) ;
$path =~ s/\/// if(substr($path, 0,1) eq '/');
sub _file {
$file = shift ;
open(FILE, $file) || die "[-] ERROR: ".$!,"\n" ;
while( ){
$cont .= $_ ;
}
close(FILE) ;
return $cont ;
}
print "write 'help' for get help list\n";
while( 1 ) {
my $sock = IO::Socket::INET->new (PeerAddr => $host,
PeerPort => $port,
Proto => 'tcp') ||
Metasploit
MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner
metasploit
MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner
MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner
This module is based on et's HTTP Directory Scanner module, with one exception. Where authentication is required, it attempts to bypass authentication using the WebDAV IIS6 Unicode vulnerability discovered by Kingcope. The vulnerability appears to be exploitable where WebDAV is enabled on the IIS6 server, and any protected folder requires either Basic, Digest or NTLM authentication.
Metasploit
MS09-020 IIS6 WebDAV Unicode Authentication Bypass
metasploit
MS09-020 IIS6 WebDAV Unicode Authentication Bypass
MS09-020 IIS6 WebDAV Unicode Authentication Bypass
This module attempts to to bypass authentication using the WebDAV IIS6 Unicode vulnerability discovered by Kingcope. The vulnerability appears to be exploitable where WebDAV is enabled on the IIS6 server, and any protected folder requires either Basic, Digest or NTLM authentication.
No writeups or analysis indexed.
http://www.attrition.org/pipermail/vim/2009-June/002192.htmlhttp://www.securityfocus.com/bid/35232http://www.securitytracker.com/id?1022358http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlhttp://www.vupen.com/english/advisories/2009/1539https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861http://www.attrition.org/pipermail/vim/2009-June/002192.htmlhttp://www.securityfocus.com/bid/35232http://www.securitytracker.com/id?1022358http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlhttp://www.vupen.com/english/advisories/2009/1539https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861
2009-06-10
Published