2021-02-24 18:11:44 +00:00
id : CVE-2017-7269
2021-02-24 13:29:23 +00:00
info :
2022-05-12 14:04:18 +00:00
name : Windows Server 2003 & IIS 6.0 - Remote Code Execution
2021-06-09 12:20:56 +00:00
author : thomas_from_offensity,geeknik
2021-02-24 13:29:23 +00:00
severity : critical
2022-05-12 14:04:18 +00:00
description : |
2022-05-13 20:26:43 +00:00
Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in the ScStoragePathFromUrl function in the WebDAV service that could allow remote attackers to execute arbitrary code via a long header beginning with "If <http://" in a PROPFIND request.
2023-09-06 13:22:34 +00:00
remediation : |
Upgrade to a supported version of Windows Server and IIS, or apply the necessary security patches.
2021-05-09 15:43:32 +00:00
reference :
2021-05-09 15:16:07 +00:00
- https://blog.0patch.com/2017/03/0patching-immortal-cve-2017-7269.html
- https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
2022-05-12 14:04:18 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2017-7269
2022-05-17 09:18:12 +00:00
- https://github.com/edwardz246003/IIS_exploit
2023-07-15 16:29:17 +00:00
- http://www.securitytracker.com/id/1038168
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 9.8
2021-09-10 11:26:40 +00:00
cve-id : CVE-2017-7269
cwe-id : CWE-119
2023-10-29 11:57:59 +00:00
epss-score : 0.97121
2023-11-20 10:14:14 +00:00
epss-percentile : 0.99732
2023-09-06 13:22:34 +00:00
cpe : cpe:2.3:a:microsoft:internet_information_server:6.0:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : microsoft
product : internet_information_server
tags : cve,cve2017,rce,windows,iis,kev
2021-02-24 13:29:23 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-02-24 13:29:23 +00:00
- method : OPTIONS
path :
- "{{BaseURL}}"
2021-05-09 17:20:07 +00:00
2021-02-24 13:29:23 +00:00
matchers-condition : and
matchers :
2023-07-11 19:49:27 +00:00
- type : dsl
dsl :
- regex("<DAV:sql>", dasl)
- regex("[\d]+(,\s+[\d]+)?", dav)
- regex(".*?PROPFIND", public)
- regex(".*?PROPFIND", allow)
condition : or
2021-02-24 13:29:23 +00:00
- type : word
2022-05-12 14:04:18 +00:00
part : header
2021-02-24 13:29:23 +00:00
words :
- "IIS/6.0"
2021-05-09 17:20:07 +00:00
2022-05-12 14:04:18 +00:00
- type : status
status :
- 200
2023-11-21 07:14:20 +00:00
# digest: 4b0a00483046022100d832f21e28b2fd2896fbac2a34906a47f973ad0a92cdc3b4c7140b603957a4120221008f1a7607a67b82eb944bd6e63ec7dcc038ea27a6934ae7dff2e04198aed194db:922c64590222798bb761d5b6d8e72950