Rules to detect IIS 6.0 WebDAV exploit
Summary: Cisco Talos published 15 Snort rules to detect attacks against IIS 6.0 servers with WebDAV enabled, keyed to Microsoft advisory 971492 and CVE-2009-1676. The rules match WebDAV methods and headers such as COPY, PROPFIND, PROPPATCH, MKCOL, MOVE, LOCK, UNLOCK, DAV, Destination, Depth, If, Lock-Token, Overwrite, Timeout and Translate, flagging requests whose paths contain percent-encoded characters in the 0x88-0xAF range.
Why it matters: The detection logic rests on a narrow signature - percent-encoded bytes in the URL - so an attacker who varies that encoding slips past all 15 rules while still reaching the same authentication bypass on any IIS 6.0 host with WebDAV turned on.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026