CVE-2002-2062 in Internet Explorer
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in ftp.htt in Internet Explorer 5.5 and 6.0, when running on Windows 2000 with "Enable folder view for FTP sites" and "Enable Web content in folders" selected, allows remote attackers to inject arbitrary web script or HTML via the hostname portion of an FTP URL.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/15/2025
This cross-site scripting vulnerability exists in the ftp.htt component of Internet Explorer versions 5.5 and 6.0 when executed on Windows 2000 systems with specific folder view configurations enabled. The flaw stems from insufficient input validation and sanitization of the hostname portion within FTP URLs, creating a pathway for malicious actors to inject arbitrary web script or HTML content. The vulnerability specifically leverages the combination of "Enable folder view for FTP sites" and "Enable Web content in folders" settings, which together create an environment where the browser processes FTP URLs through the ftp.htt handler without adequate security controls.
The technical implementation of this vulnerability occurs when Internet Explorer processes an FTP URL containing malicious script within the hostname parameter. The ftp.htt component fails to properly escape or filter special characters in the hostname portion, allowing attackers to inject HTML tags or JavaScript code that executes in the context of the user's browser session. This occurs because the component treats the hostname field as trusted input without proper sanitization, particularly when the browser is configured to display FTP folder contents in a web-like interface. The vulnerability represents a classic XSS flaw where user-supplied data flows directly into the browser's rendering engine without adequate protection mechanisms.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform session hijacking, steal cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users. Attackers can craft specially formatted FTP URLs that, when visited by victims, execute malicious code in the victim's browser context, potentially compromising the entire user session. This vulnerability is particularly dangerous in corporate environments where users may browse FTP sites containing untrusted content, as it can be exploited through social engineering techniques or by compromising FTP servers that serve maliciously crafted URLs. The attack vector requires minimal user interaction, making it particularly effective for phishing campaigns or credential theft operations.
Organizations should immediately disable the problematic folder view settings in Internet Explorer, specifically turning off "Enable folder view for FTP sites" and "Enable Web content in folders" to prevent exploitation of this vulnerability. System administrators should also implement web application firewalls and content filtering solutions that can detect and block malicious script injection attempts in URL parameters. The vulnerability aligns with CWE-79, which describes cross-site scripting flaws, and can be categorized under ATT&CK technique T1566 for initial access through malicious content. Additionally, this vulnerability demonstrates the importance of input validation and output encoding principles, as outlined in the OWASP Top Ten, and represents a failure to implement proper security controls for URL parsing and content rendering in web browsers.