CVE-2002-1744 in IIS
Summary
by MITRE
Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary files via a hex-encoded "%c0%ae%c0%ae" string, which is the Unicode representation for ".." (dot dot).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/09/2025
This vulnerability resides in Microsoft Internet Information Services 5.0 and specifically targets the CodeBrws.asp component which handles directory browsing functionality. The flaw represents a classic directory traversal attack vector that exploits how the web server processes Unicode encoded sequences. Attackers can leverage the hex-encoded sequence "%c0%ae%c0%ae" to manipulate file path resolution and gain unauthorized access to sensitive system files. This particular encoding uses the Unicode character U+00AE (registered trademark symbol) which when processed by IIS 5.0 gets interpreted as the traditional ".." directory navigation sequence that should be blocked by proper input validation.
The technical implementation of this vulnerability stems from inadequate input sanitization within the IIS 5.0 web server software. When the CodeBrws.asp component processes user-supplied input containing the Unicode encoded traversal sequence, it fails to properly validate or normalize the input before performing file system operations. This allows attackers to bypass normal path validation mechanisms that would typically prevent access to parent directories. The vulnerability is particularly dangerous because it operates at the application layer and can be exploited through standard HTTP requests without requiring special privileges or authentication. The Unicode representation bypasses simple string matching techniques that might otherwise detect traditional ".." sequences in the URL.
The operational impact of this vulnerability is significant as it enables attackers to access not only source code files but also potentially sensitive configuration data, system files, and other confidential information stored on the web server. This can lead to complete system compromise through information disclosure, allowing attackers to gather intelligence about the server environment, application architecture, and potentially discover additional vulnerabilities. The ability to determine the existence of arbitrary files through this method provides attackers with valuable reconnaissance data that can be used for further exploitation attempts. According to CWE standards, this maps to CWE-22 which describes improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal.
Mitigation strategies for this vulnerability include applying the official Microsoft security patch that addresses the input validation flaw in IIS 5.0's CodeBrws.asp component. Organizations should also implement proper input validation and sanitization at all application layers, particularly when handling user-supplied data that might be used in file system operations. Network-level defenses such as web application firewalls can help detect and block suspicious Unicode sequences that attempt to exploit this vulnerability. Additionally, implementing strict file access controls and ensuring that web applications do not have unnecessary directory browsing capabilities can significantly reduce the attack surface. From an ATT&CK framework perspective, this vulnerability aligns with techniques related to credential access and reconnaissance, specifically T1083 (File and Directory Discovery) and T1566 (Phishing with Malicious Attachments) where the initial reconnaissance phase can lead to more sophisticated attacks. Regular security assessments and vulnerability scanning should be performed to identify similar path traversal issues in legacy systems, as many organizations continue to maintain older IIS installations that may be susceptible to similar flaws.