File Extension Bypass Vulnerability in Microsoft Internet Information Services

CVE-2009-4444

What is CVE-2009-4444?

The vulnerability in Microsoft Internet Information Services (IIS) 5.x and 6.x arises from the improper handling of filename extensions. Specifically, the server evaluates only the portion of the filename preceding a semicolon, which can be exploited by attackers to circumvent file extension restrictions imposed by third-party upload applications. This flaw allows the use of dangerous extensions like .asp, .cer, and .asa with a semicolon followed by a benign extension (e.g., .jpg), potentially leading to unauthorized access to sensitive functionalities enabled by these script types.

References