IIS 6.0 CVE-2017-7269

WebDAV publishing service must be enabled in IIS 6.0 configuration (not enabled by default in all installation profiles but commonly active on file-sharing or collaborative document management servers). The vulnerable ScStoragePathFromUrl function is only invoked when processing WebDAV PROPFIND requests, so standard HTTP/HTTPS traffic does not trigger the vulnerability. No authentication required-exploitation succeeds against default configurations with anonymous WebDAV access enabled (common for public-facing document repositories). No user interaction needed-attack executes server-side upon receipt of malicious request. Platform-specific: only affects Windows Server 2003 R2 and Windows XP Professional x64 Edition running IIS 6.0; later Windows versions ship IIS 7.0+ with completely rewritten WebDAV implementation immune to this flaw. Network accessibility to TCP ports 80 or 443 is required (AV:N), but attack complexity is low (AC:L) with reliable exploits requiring no race conditions or environmental dependencies.

This represents CRITICAL real-world risk with multiple converging threat indicators. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects perfect exploitability-network-accessible, low complexity, no authentication or user interaction required. EPSS 94.43% (100th percentile) confirms sustained mass exploitation. CISA KEV listing verifies active exploitation confirmed by US government threat intelligence, with exploitation beginning 7-8 months before public disclosure in March 2017, indicating initial use as a zero-day. Multiple weaponized exploits exist in public repositories (Exploit-DB, Metasploit, GitHub) lowering attacker skill requirements to script-kiddie level. SSVC factors: Exploitation=Active, Automatable=Yes (wormable via network scanning + automatic exploitation), Technical Impact=Total (arbitrary code execution as SYSTEM-level service account). However, real-world exposure is constrained by platform obsolescence-Windows Server 2003 reached EOL in 2015, so vulnerable systems represent either air-gapped/isolated legacy infrastructure, embedded/ICS environments unable to migrate, or severely neglected internet-facing servers. Shodan/Censys scans in 2017 identified tens of thousands of vulnerable IIS 6.0 instances internet-accessible, making this a priority for asset discovery and emergency patching despite platform age. Organizations still running Server 2003 likely face significant exposure as this system class typically indicates broader security debt.

An attacker performs internet-wide scanning (Shodan, Masscan) to identify servers responding with 'Server: Microsoft-IIS/6.0' headers on port 80/443. Upon identifying a target running IIS 6.0 with WebDAV enabled (detectable via OPTIONS request returning DAV: header), the attacker sends a malicious PROPFIND request with a crafted 'If: <http://' header exceeding buffer limits, containing shellcode in the overflowed data. The buffer overflow overwrites the stack return address, redirecting execution to attacker-controlled shellcode which executes with NT AUTHORITY\NETWORK SERVICE or SYSTEM privileges. The attacker establishes a reverse shell, installs persistence mechanisms, and pivots to internal network resources. Multiple public Metasploit modules and standalone Python/Ruby exploits automate this entire process, enabling mass exploitation campaigns. Given CISA KEV confirmation, real-world scenarios likely include botnet recruitment, ransomware deployment, and APT initial access operations targeting government, healthcare, and industrial sectors still operating legacy infrastructure.