Last revised: --
Source: CERT/CC
A complete revision history is at the end of this file.
A serious vulnerability in Microsoft IIS may allow remote intruders to
execute commands on an IIS web server. This vulnerability closely
resembles a previous vulnerability in IIS that was widely
exploited. The CERT/CC urges IIS administrators to take action to
correct this vulnerability.
URIs may be encoded according to RFC 2396. Among other
things, this RFC provides an encoding for arbitrary octets using the
percent sign (%) and hexadecimal characters.
Quoting from RFC 2396:
An escaped octet is encoded as a character triplet, consisting of the
percent character "%" followed by the two hexadecimal digits
representing the octet code. For example, "%20" is the escaped
encoding for the US-ASCII space character.
escaped = "%" hex hex Like all web servers, Microsoft IIS decodes input URIs to a
canonical format. Thus, the following encoded string:
Unfortunately, IIS decodes some of the input twice. The
second decoding is superfluous. Security checks are applied to the
results of the first decoding, but IIS utilizes the results of the
second decoding. If the results of the first decoding pass the
security checks and the results of the second decoding refer to a
valid file, access will be granted to the file even if it should not
be. More information is available at
Note that this does not permit intruders to bypass ACLs enforced by
the filesystem, only security checks performed by IIS. We encourage
you to configure your web server according to the guidelines provided
in
Theses guidelines can help you reduce your exposure to this
problem, and possibly to problems that have not yet been discovered.
This issue was discovered by NSFocus.
The CVE Project has assigned the following identifier to this
vulnerability:
This vulnerability has many similarities to the Web Server Folder
Directory Traversal Vulnerability, which has been widely exploited. For more
information on that vulnerability, see
Intruders can run arbitrary commands with the privileges of the
IUSR_machinename account.
Information on patches from Microsoft is available at
Additional advice on securing IIS web servers is available from
The following documents regarding this vulnerability are available
from Microsoft:
Copyright 2001 Carnegie Mellon University. Revision History
Systems Affected
Overview
I. Description
hex = digit | "A" | "B" | "C" | "D" | "E" | "F"
will get decoded to
II. Impact
III. Solutions
Apply a patch from your vendor
Appendix A. Vendor Information
Microsoft Corporation
May 15, 2001: Initial Release