Executive brief
Microsoft Internet Information Services (IIS) 1.0, a web server used to host websites, contains a critical flaw that allows remote users to run unauthorized commands on the server. By using specific file types like .bat or .cmd, an attacker could gain full control over the web server, potentially leading to the theft of sensitive data, website defacement, or a complete shutdown of services. This vulnerability poses a severe risk to the integrity and availability of the affected system.
Technical details
Microsoft Internet Information Services (IIS) 1.0 fails to properly restrict or sanitize requests for executable script files. An unauthenticated remote attacker can exploit this by submitting requests for .bat or .cmd files, which the server then executes with high privileges. This vulnerability is a form of command injection/arbitrary command execution. Successful exploitation allows the attacker to execute any command on the underlying operating system with the permissions of the web server process, typically leading to full system compromise. Microsoft has historically addressed this through security updates and configuration changes to script mappings.
Affected products
- Microsoft Internet Information Services (IIS) 1.0
Timeline
- 1996-02-25: disclosed: Initial publication date.