CVE-2017-7269
Microsoft Windows Server Buffer Overflow Vulnerability
Description
CVE-2017-7269 is a CRITICAL buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0 on Windows Server 2003 R2, carrying a CVSS 3.1 score of 9.8. The vulnerability exists in the ScStoragePathFromUrl function in the WebDAV service, allowing remote attackers to execute arbitrary code via a crafted PROPFIND request with an overly long "If" header. This vulnerability was exploited in the wild as early as July 2016, predating its public disclosure in March 2017. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.94411 (99.98th percentile), this is one of the most widely exploited vulnerabilities ever tracked.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet information services | 6.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/97127(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038168(Broken Link, Third Party Advisory, VDB Entry)
- https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html(Exploit, Third Party Advisory)
- https://github.com/danigargu/explodingcan(Exploit)
- https://github.com/edwardz246003/IIS_exploit(Broken Link, Third Party Advisory)
- https://github.com/rapid7/metasploit-framework/pull/8162(Issue Tracking, Patch)
- https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812(Exploit)
- https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-server(Broken Link, Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/41738/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41992/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7269(US Government Resource)
Weakness Type
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVE-2017-7269 is classified under CWE-120 — Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'). Classic Buffer Overflow is a vulnerability that occurs when a program copies data to a buffer without first checking that the data fits within the buffer's allocated size. This typically happens when functions like strcpy(), gets(), sprintf(), or memcpy() are used without proper bounds checking. When the input data exceeds the buffer capacity, it overwrites adjacent memory locations, potentially corrupting data, crashing the program, or enabling arbitrary code execution.
In the context of IIS 6.0's WebDAV service, this weakness is particularly dangerous because the ScStoragePathFromUrl function processes URL paths from incoming HTTP requests without adequate length validation. The buffer overflow occurs when processing an overly long "If" header in a PROPFIND request, allowing attackers to overwrite the stack and redirect execution to attacker-controlled shellcode. Since IIS runs with elevated privileges, successful exploitation results in complete system compromise.
Learn more: CWE-120 — Buffer Copy without Checking Size of Input
Impact Analysis
CVE-2017-7269 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker complete access to all data on the affected Windows Server 2003 R2 system, including files, databases, credentials, and any information processed by IIS-hosted applications.
Integrity (HIGH): Attackers can execute arbitrary code with the privileges of the IIS service, allowing modification of web content, system files, registry entries, installation of backdoors, and deployment of malware.
Availability (HIGH): Complete denial of service is possible, including crashing the IIS service, rendering hosted websites and applications unavailable, or completely disabling the server through destructive payloads.
Scope Unchanged: The vulnerability scope is Unchanged (U), meaning impact is contained within the IIS/Windows Server environment. However, given that IIS 6.0 typically runs with SYSTEM privileges, exploitation effectively grants full control of the server.
With an EPSS score of 0.94411 (99.98th percentile), this is among the most exploited vulnerabilities in existence, reflecting its trivial exploitability and the large number of legacy IIS 6.0 servers still reachable on the internet.
Exploit Maturity
CVE-2017-7269 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability was exploited in the wild since at least July 2016, months before its public disclosure in March 2017. The EPSS score of 0.94411 (99.98th percentile) places it among the most widely exploited vulnerabilities ever tracked. Multiple public exploits are available, including Metasploit modules and standalone proof-of-concept code.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2017-7269. However, the vulnerability has been used by various threat actors for cryptomining, data theft, and establishing persistent access to compromised servers.
Attack surface: Fully weaponized exploit code is publicly available on Exploit-DB and GitHub. Metasploit includes a reliable exploit module. The attack requires only network access to IIS with WebDAV enabled, making exploitation trivial. Windows Server 2003 R2 reached end of life in July 2015, so no official patch was initially available.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. Organizations still running Windows Server 2003 R2 with IIS 6.0 face extreme risk and should migrate immediately.
Remediation
- Migrate off Windows Server 2003 R2 immediately. Windows Server 2003 reached end of life in July 2015 and no longer receives security updates. Migrate all workloads to a supported Windows Server version or alternative platform.
- Disable WebDAV if migration is delayed. As an interim measure, disable the WebDAV service on all IIS 6.0 instances. This eliminates the attack vector for CVE-2017-7269 without requiring a full server migration.
- Apply the emergency patch if available. Microsoft released an out-of-band security update (KB3197835) for Windows Server 2003 in June 2017. Apply this patch to any remaining IIS 6.0 instances while planning migration.
- Implement network-level restrictions. Place any remaining IIS 6.0 servers behind a web application firewall that can filter malicious PROPFIND requests. Restrict network access to only required clients and block public internet exposure.
- Scan for signs of prior exploitation. Given that this vulnerability was exploited since at least mid-2016, thoroughly investigate any IIS 6.0 servers for webshells, unauthorized accounts, cryptominers, or other indicators of compromise.
- Inventory and decommission legacy systems. Identify all Windows Server 2003 instances in your environment. Create a migration plan with defined timelines and prioritize internet-facing systems for immediate decommissioning.
Technical Details
CVE-2017-7269 is a CRITICAL-severity buffer overflow in the WebDAV service of IIS 6.0 on Windows Server 2003 R2 that can be exploited remotely over the network. The attack complexity is low, requiring no authentication, no prior privileges, and no user interaction.
Technical mechanism: The vulnerability exists in the ScStoragePathFromUrl function within the WebDAV service. When processing a PROPFIND HTTP request, the function parses the "If" header value and converts storage paths from URLs. The function fails to validate the length of the input URL before copying it into a fixed-size stack buffer. By sending a PROPFIND request with an "If" header beginning with "If: <http://" followed by an overly long string, an attacker triggers a stack-based buffer overflow that overwrites the return address and allows execution of arbitrary shellcode.
Exploitation details: The exploit sends a specially crafted PROPFIND request to the WebDAV endpoint. The buffer overflow allows precise control over the instruction pointer (EIP), enabling classic stack smashing. Since Windows Server 2003 lacks modern exploit mitigations like ASLR and DEP enforcement on the stack, exploitation is highly reliable.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects network-based access, low complexity, no privileges or user interaction required, unchanged scope, and maximum impact across all three CIA dimensions.
Frequently Asked Questions
Is CVE-2017-7269 being actively exploited?
Yes, CVE-2017-7269 has been actively exploited since at least July 2016. It is listed in CISA's KEV catalog and has an EPSS score of 0.94411 (99.98th percentile), making it one of the most widely exploited vulnerabilities ever tracked. Multiple public exploit tools, including Metasploit modules, are readily available.
Which products are affected by CVE-2017-7269?
CVE-2017-7269 specifically affects Microsoft Internet Information Services (IIS) 6.0 running on Windows Server 2003 R2. The vulnerability is in the WebDAV service's ScStoragePathFromUrl function. Only systems with WebDAV enabled are vulnerable. Later versions of IIS and Windows Server are not affected.
How do I fix CVE-2017-7269?
The primary recommendation is to migrate off Windows Server 2003 R2 entirely, as it reached end of life in July 2015. As interim measures, disable WebDAV on IIS 6.0, apply the emergency patch KB3197835 if available, and place affected servers behind a web application firewall. Block public internet access to any remaining IIS 6.0 instances.
How severe is CVE-2017-7269?
CVE-2017-7269 is rated CRITICAL with the maximum CVSS 3.1 score of 9.8. It allows unauthenticated remote code execution with no user interaction required. The EPSS score of 0.94411 (99.98th percentile) reflects its extreme exploitability. The affected platform, Windows Server 2003, lacks modern exploit mitigations, making attacks highly reliable.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.