Description
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner
auxiliary/scanner/http/dir_webdav_unicode_bypass
-
MS09-020 IIS6 WebDAV Unicode Authentication Bypass
auxiliary/scanner/http/ms09_020_webdav_unicode_bypass
Exploit-DB 1
- Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2) EDB-8806 · remote · May 26, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- oval:org.mitre.oval:def:5861 vdb-entry signature
- 1022358 vdb-entry
- MS09-020 vendor-advisory
- 35232 vdb-entry
- TA09-160A third-party-advisory
- ADV-2009-1539 vdb-entry
- 20090616 IIS WebDav Vulnerability CVE ID mailing-list