CVE-2010-2731

Microsoft IIS 5.1 on Windows XP SP3 - Directory Authentication Bypass via Crafted Request

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2010-2731. PoCs published by Soroush Dalili, Soroush Dalili, sinn3r, including Metasploit module auxiliary/admin/http/iis_auth_bypass.

AI-analyzed exploit summary This exploit describes a directory authentication bypass vulnerability in IIS using Alternate Data Stream (ADS) to circumvent authentication methods. The technique involves appending ':$i30:$INDEX_ALLOCATION' to a directory name to access protected folders.

Description

Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.1 on Windows XP SP3, when directory-based Basic Authentication is enabled, allows remote attackers to bypass intended access restrictions and execute ASP files via a crafted request, aka "Directory Authentication Bypass Vulnerability."

Exploits (2)

exploitdb WRITEUP VERIFIED
by Soroush Dalili · textremotewindows
https://www.exploit-db.com/exploits/14179

This exploit describes a directory authentication bypass vulnerability in IIS using Alternate Data Stream (ADS) to circumvent authentication methods. The technique involves appending ':$i30:$INDEX_ALLOCATION' to a directory name to access protected folders.

Classification
Writeup 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS 5.1
No auth needed
Prerequisites: Access to the target IIS server · Knowledge of protected directory paths
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC
by Soroush Dalili, sinn3r · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/iis_auth_bypass.rb

This Metasploit module exploits an authentication bypass vulnerability in Microsoft IIS 5 by appending an NTFS stream name to the directory path, allowing unauthorized access to protected resources.

Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS 5
No auth needed
Prerequisites: Target running Microsoft IIS 5 with basic authentication enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6942

Scores

EPSS 0.3112
EPSS Percentile 98.0%

Details

CWE
CWE-287
Status published
Published Sep 15, 2010
Tracked Since Feb 18, 2026