Vulnerability record · CVE-2000-0302 · published 31 March 2000
CVE-2000-0302: Microsoft Index Server ASP source disclosure via null.htw
Microsoft · Index Server
Microsoft Index Server can be tricked into returning the source code of ASP files instead of executing them by appending a %20 to the filename in the CiWebHitsFile argument of a null.htw URL. This exposes server-side script source, which often contains credentials, connection strings and business logic. The flaw is remotely reachable without authentication.
Description
Microsoft Index Server allows remote attackers to view the source code of ASP files by appending a %20 to the filename in the CiWebHitsFile argument to the null.htw URL.
AV:N/AC:L/Au:N/C:P/I:N/A:N
Automated analysis
high priorityUnauthenticated remote source-code disclosure with a very high EPSS score, though the product is legacy and no KEV listing or public exploit tag is present.
What it is
Microsoft Index Server can be tricked into returning the source code of ASP files instead of executing them by appending a %20 to the filename in the CiWebHitsFile argument of a null.htw URL. This exposes server-side script source, which often contains credentials, connection strings and business logic. The flaw is remotely reachable without authentication.
Impact
An unauthenticated attacker gains read access to ASP source files, disclosing embedded secrets, database credentials and application logic that can enable further attacks.
Attack surface
Reached over the network via HTTP requests to the null.htw endpoint with a crafted CiWebHitsFile argument; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no exploit tags appear in the references, but EPSS is very high (0.786, 99.6th percentile), indicating strong predicted exploitation activity.
What to do
- Apply the Microsoft security bulletin MS00-006 fix for Index Server, or upgrade to a supported product version.
- Disable or remove Index Server and the null.htw sample script if the indexing feature is not required.
- Restrict network access to the Index Server web endpoints to trusted clients only.
- Move sensitive configuration and credentials out of ASP source files so disclosure has limited value.
Detection
- Search web logs for requests to null.htw containing CiWebHitsFile parameters, especially with %20 or encoded whitespace appended to filenames.
- Alert on HTTP responses returning ASP source content (for example '<%' or 'Server.CreateObject') instead of rendered HTML.
- Monitor for repeated or automated requests to .htw endpoints from single sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2000-0302 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2000-0302), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
