Microsoft IIS 2.0/3.0/4.0/5.0/5.1 Internal IP Address Disclosure Vulnerability
2014-07-01T00:00:00
ID SSV:73992 Type seebug Reporter Root Modified 2014-07-01T00:00:00
Description
No description provided by source.
source: http://www.securityfocus.com/bid/1499/info
When a remote user attempts to access an area protected by basic authentication with no realm defined, while specifying HTTP 1.0, Microsoft IIS will return an Access Denied error message containing the internal IP address of the host. Even if IIS is behind a firewall or NAT, it will disclose the true internal IP address to the remote user.
The internal IP address may also be revealed through a HTTP request made with an empty host name. If a PROPFIND HTTP request is made, the message returned will include the IP address as part of the HREF header. The IP address may also be exposed through the WRITE or MKCOL methods, although they would not normally be exposed to the external network.
Eg.
telnet target 80
Trying target...
Connected to target.
Escape character is '^]'.
HEAD /directory HTTP/1.0[CRLF]
[CRLF]
HTTP/1.1 401 Access Denied
WWW-Authenticate: Basic realm="<Internal IP Address>"
Content-Length: 644
Content-Type: text/html
{"type": "seebug", "viewCount": 5, "enchantments": {"score": {"value": -0.1, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": -0.1}, "reporter": "Root", "title": "Microsoft IIS 2.0/3.0/4.0/5.0/5.1 Internal IP Address Disclosure Vulnerability", "cvelist": [], "bulletinFamily": "exploit", "sourceHref": "https://www.seebug.org/vuldb/ssvid-73992", "cvss": {"score": 0.0, "vector": "NONE"}, "references": [], "enchantments_done": [], "modified": "2014-07-01T00:00:00", "description": "No description provided by source.", "href": "https://www.seebug.org/vuldb/ssvid-73992", "id": "SSV:73992", "status": "cve,poc", "lastseen": "2017-11-19T13:28:51", "sourceData": "\n source: http://www.securityfocus.com/bid/1499/info\r\n\r\nWhen a remote user attempts to access an area protected by basic authentication with no realm defined, while specifying HTTP 1.0, Microsoft IIS will return an Access Denied error message containing the internal IP address of the host. Even if IIS is behind a firewall or NAT, it will disclose the true internal IP address to the remote user.\r\n\r\nThe internal IP address may also be revealed through a HTTP request made with an empty host name. If a PROPFIND HTTP request is made, the message returned will include the IP address as part of the HREF header. The IP address may also be exposed through the WRITE or MKCOL methods, although they would not normally be exposed to the external network.\r\n\r\nEg.\r\n\r\ntelnet target 80\r\nTrying target...\r\nConnected to target.\r\nEscape character is '^]'.\r\nHEAD /directory HTTP/1.0[CRLF]\r\n[CRLF]\r\n\r\nHTTP/1.1 401 Access Denied\r\nWWW-Authenticate: Basic realm="<Internal IP Address>"\r\nContent-Length: 644\r\nContent-Type: text/html \n ", "published": "2014-07-01T00:00:00", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645511037}}