CVE-2009-1535
Internet Information Services 5.1 and 6.0 - Authentication Bypass via Unicode %c0%af URI Obfuscation
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2009-1535.
PoCs published by aushack, et, aushack, including Metasploit module auxiliary/scanner/http/dir_webdav_unicode_bypass.
AI-analyzed exploit summary This Perl script exploits CVE-2009-1535, a WebDAV authentication bypass vulnerability in Microsoft IIS 6.0. It uses a Unicode encoding trick (%c0%af) to bypass authentication and allows file retrieval, directory listing, and file upload via crafted HTTP requests.
Description
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122.
Exploits (4)
This Perl script exploits CVE-2009-1535, a WebDAV authentication bypass vulnerability in Microsoft IIS 6.0. It uses a Unicode encoding trick (%c0%af) to bypass authentication and allows file retrieval, directory listing, and file upload via crafted HTTP requests.
This is a detailed technical writeup describing a Unicode-based authentication bypass vulnerability in Microsoft IIS 6.0 WebDAV. The vulnerability allows attackers to bypass password protection by injecting Unicode characters into the URI, enabling unauthorized file access and directory listing.
This Metasploit module scans for directories on IIS6 servers with WebDAV enabled, attempting to bypass authentication using a Unicode vulnerability (CVE-2009-1122). It sends PROPFIND requests with malformed Unicode paths to detect vulnerable endpoints.
This Metasploit module exploits a Unicode authentication bypass vulnerability in IIS6 WebDAV (CVE-2009-1535). It sends a crafted PROPFIND request with an overlong Unicode-encoded path to bypass authentication on protected folders.