CVE-2009-1535 in IIS
Summary
by MITRE
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/09/2025
The vulnerability described in CVE-2009-1535 represents a critical authentication bypass flaw within Microsoft Internet Information Services versions 5.1 and 6.0 that specifically affects the WebDAV extension functionality. This vulnerability exploits a fundamental weakness in how IIS handles URI encoding, particularly when processing Unicode characters within URL paths. The flaw enables remote attackers to circumvent access controls that would normally protect sensitive directories and files, potentially allowing unauthorized access to protected resources. The vulnerability specifically leverages the Unicode character %c0%af, which represents a special character in the UTF-8 encoding scheme, to manipulate the path resolution process within IIS's WebDAV implementation.
The technical mechanism behind this vulnerability involves the improper handling of percent-encoded Unicode characters within URI paths during WebDAV operations. When IIS processes a URI containing the %c0%af character at arbitrary positions, particularly within directory path components, the WebDAV extension fails to properly normalize or validate the URI structure. This misconfiguration allows the attacker to manipulate the path traversal logic, effectively bypassing the authentication mechanisms that should protect directories such as protected\ folders. The vulnerability demonstrates a classic case of improper input validation and normalization, where the system fails to properly sanitize or canonicalize URI paths before processing them for access control decisions. This weakness specifically affects the WebDAV extension's interpretation of path components, allowing attackers to inject malicious path elements that are subsequently ignored or misinterpreted by the authentication system.
The operational impact of this vulnerability extends far beyond simple information disclosure, as it provides attackers with full read, write, and create capabilities within protected directories. An attacker could potentially enumerate folder contents, access sensitive files, modify existing resources, or even upload malicious content to compromise the entire web server. The vulnerability affects organizations running IIS 5.1 and 6.0 systems, which were common in enterprise environments during the late 2000s, making it a significant concern for legacy systems that had not been properly updated. The authentication bypass occurs at the WebDAV level, meaning that even if traditional HTTP authentication mechanisms were properly configured, the vulnerability allows attackers to circumvent these protections entirely. This creates a scenario where an attacker could gain access to sensitive corporate data, potentially leading to data breaches, system compromise, or further lateral movement within the network infrastructure.
Security mitigations for this vulnerability primarily involve applying the official Microsoft security patches that address the WebDAV URI handling behavior in IIS 5.1 and 6.0. Organizations should immediately implement the security updates provided by Microsoft to correct the improper URI normalization logic within the WebDAV extension. Additionally, system administrators should disable WebDAV functionality on IIS servers when it is not required, as this eliminates the attack surface entirely. Network segmentation and firewall rules can help limit access to WebDAV endpoints, though these measures do not address the core vulnerability. The vulnerability maps to CWE-185, which covers improper normalization of Unicode characters, and aligns with ATT&CK technique T1190 for exploitation of remote services. Organizations should also consider implementing robust monitoring and logging of WebDAV activities to detect potential exploitation attempts, as the authentication bypass may not generate obvious audit trails. Regular security assessments of legacy IIS systems are crucial, as these older versions are no longer supported by Microsoft and continue to pose significant security risks.