CVE-2015-1635
Microsoft HTTP.sys Remote Code Execution Vulnerability
Description
CVE-2015-1635 is a CRITICAL remote code execution vulnerability in the Microsoft HTTP protocol stack (HTTP.sys), carrying a CVSS 3.1 score of 9.8. Classified under CWE-94 (Improper Control of Generation of Code), the vulnerability allows unauthenticated remote attackers to execute arbitrary code by sending a specially crafted HTTP request to Windows systems running IIS (Internet Information Services). Affected systems include Windows 7, Windows 8, Windows 8.1, Windows Server 2008 R2, and Windows Server 2012/R2. The flaw exists in HTTP.sys, a kernel-mode driver that handles HTTP requests, making exploitation particularly dangerous as it runs with highest system privileges. This CVE was added to CISA's KEV catalog on February 10, 2022, with a remediation deadline of August 10, 2022. The EPSS score of 94.31% (99.95th percentile) confirms extremely widespread exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 7 | - |
| microsoft | windows 8 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows server 2008 | r2 |
| microsoft | windows server 2012 | -; r2 |
References
- http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.osvdb.org/120629(Broken Link)
- http://www.securityfocus.com/bid/74013(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1032109(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/36773/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/36776/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1635(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code
CVE-2015-1635 is classified under CWE-94 — Improper Control of Generation of Code (Code Injection). This weakness occurs when software constructs code dynamically using external input without adequately sanitizing or validating that input, allowing an attacker to inject and execute arbitrary code.
In the context of HTTP.sys, the Windows kernel-mode HTTP driver processes HTTP requests including Range headers for partial content retrieval. The vulnerability lies in how HTTP.sys handles crafted Range header values that cause an integer overflow in the kernel, leading to a buffer overflow condition. Because HTTP.sys operates at the kernel level and processes requests before they reach the web application, the vulnerability affects any Windows system running IIS regardless of the web application being hosted.
Impact Analysis
CVE-2015-1635 carries a CVSS 3.1 base score of 9.8 (CRITICAL) with devastating potential due to kernel-mode exploitation.
Confidentiality (High): Kernel-level code execution on a web server grants unrestricted access to all hosted applications, databases, user credentials, SSL/TLS private keys, and all data on the server. The attacker can intercept all incoming and outgoing HTTP traffic.
Integrity (High): With kernel privileges, an attacker can modify any file, install rootkits, inject malicious content into web responses, compromise hosted applications, and create persistent backdoors that survive application-level security monitoring.
Availability (High): The vulnerability can be trivially used for denial of service — even failed exploitation attempts can cause a Blue Screen of Death (BSOD), crashing the server. Successful exploitation allows the attacker to take the web server completely offline.
No authentication or interaction required: The attack requires no privileges (PR:N) and no user interaction (UI:N). Any system running IIS with HTTP.sys is vulnerable to anyone who can send an HTTP request.
With an EPSS score of 94.31% (99.95th percentile), this is among the most actively exploited vulnerabilities tracked.
Exploit Maturity
CVE-2015-1635 has an extremely high exploit maturity with multiple public proof-of-concept exploits and confirmed active exploitation.
Public exploits: Multiple exploit modules are available on Exploit-DB (36773 and 36776) and Packet Storm Security (131463). The Metasploit framework includes modules for both DoS and RCE exploitation.
Trivial DoS exploitation: A single crafted HTTP request with a malicious Range header can crash the target server with a BSOD. This makes denial-of-service attacks extremely easy and requires minimal sophistication.
KEV listing: CISA added CVE-2015-1635 to the KEV catalog on February 10, 2022, confirming active exploitation. The remediation deadline was August 10, 2022.
Ransomware association: CISA's KEV does not indicate a direct ransomware association, but kernel-level RCE on web servers is a high-value capability for any threat actor.
Wormable potential: Because the vulnerability can be triggered by any HTTP request to IIS and requires no authentication, it is inherently wormable — automated propagation across the internet is possible.
EPSS context: The EPSS score of 94.31% (99.95th percentile) confirms pervasive exploitation.
Remediation
-
Apply Microsoft security bulletin MS15-034 immediately. Install the patch from Microsoft's security bulletin for all affected Windows versions. This update corrects how HTTP.sys handles Range requests.
-
Verify patch application through testing. After patching, send a test request with a crafted Range header to verify the fix is in place. A patched system returns HTTP 400 Bad Request; an unpatched system may crash or return unexpected results.
-
Enable IIS kernel-mode authentication caching controls. Configure IIS to disable kernel-mode caching if it is not required, reducing the HTTP.sys attack surface for certain exploitation paths.
-
Implement web application firewall rules. Deploy WAF rules to detect and block HTTP requests containing anomalous Range header values. Filter requests with extremely large or negative Range values.
-
Monitor for exploitation attempts. Configure IIS logging to capture full request headers and monitor for requests with suspicious Range header patterns. Alert on any BSOD events on IIS servers, which may indicate exploitation attempts.
-
Ensure IIS servers are not directly exposed. Place IIS servers behind a reverse proxy or load balancer that can normalize HTTP headers before forwarding to the backend, providing an additional defense layer.
Technical Details
CVE-2015-1635 is a remote code execution vulnerability in HTTP.sys, the kernel-mode HTTP protocol driver used by Windows IIS and other HTTP-based services.
Attack vector and prerequisites: Network-based (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N). The attacker sends a single crafted HTTP request to any IIS-hosted endpoint.
Exploitation mechanism: The vulnerability exists in how HTTP.sys processes the HTTP Range header. The Range header is used for partial content requests (e.g., resuming downloads). A specially crafted Range header with values that cause an integer overflow triggers a kernel buffer overflow in the HTTP.sys driver. The overflow occurs in the code that calculates buffer sizes for the response, allowing the attacker to overwrite kernel memory.
DoS vs. RCE: The simplest exploitation is denial of service — a crafted Range header crashes the system with a BSOD. Full remote code execution requires more sophisticated heap manipulation but is achievable and provides kernel-level (Ring 0) code execution.
Kernel-mode impact: Because HTTP.sys processes HTTP requests in kernel mode before they reach user-mode IIS worker processes, the vulnerability operates at the highest privilege level. This means exploitation bypasses all application-level security controls.
Affected systems: Windows 7, Windows 8, Windows 8.1, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 running IIS with HTTP.sys.
Test detection: Sending a request with header Range: bytes=0-18446744073709551615 to an unpatched server will cause a BSOD, confirming vulnerability (use only in testing environments).
Frequently Asked Questions
What is CVE-2015-1635?
CVE-2015-1635 is a critical remote code execution vulnerability in HTTP.sys, the Windows kernel-mode HTTP driver used by IIS. A single crafted HTTP request with a malicious Range header can achieve kernel-level code execution or crash the server with a Blue Screen of Death. The CVSS score is 9.8.
How easy is it to exploit CVE-2015-1635?
Extremely easy for denial of service — a single HTTP request with a crafted Range header will crash the target server. Remote code execution requires more sophisticated exploitation but is achievable. Public proof-of-concept code and Metasploit modules are widely available, making exploitation accessible to attackers of varying skill levels.
How do I fix CVE-2015-1635?
Apply Microsoft security bulletin MS15-034. After patching, verify the fix by testing with a crafted Range header — patched systems return HTTP 400 instead of crashing. Implement WAF rules to block anomalous Range headers as defense-in-depth, and ensure IIS servers are behind reverse proxies.
How severe is CVE-2015-1635?
CVE-2015-1635 is rated CRITICAL with a CVSS score of 9.8. The EPSS score of 94.31% (99.95th percentile) confirms extremely active exploitation. The vulnerability's kernel-mode execution context, trivial DoS capability, and wormable nature make it one of the most dangerous web server vulnerabilities ever disclosed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.