Description
IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response, or (2) via the WRITE or MKCOL method, which leaks the IP in the Location server header.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
Microsoft IIS HTTP Internal IP Disclosure
auxiliary/scanner/http/iis_internal_ip
-
HTTP WebDAV Internal IP Scanner
auxiliary/scanner/http/webdav_internal_ip
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- iis-request-ip-disclosure(8385) vdb-entry
- 20020305 IIS Internal IP Address Disclosure (#NISR05032002B) mailing-list
- 20020305 IIS Internal IP Address Disclosure (#NISR05032002B) mailing-list
- 13431 vdb-entry