Vulnerability record · CVE-2007-2815 · published 22 May 2007
CVE-2007-2815: IIS 5.0 webhits.dll hit-highlighting authentication bypass
Microsoft · Internet Information Services
The hit-highlighting feature in webhits.dll on Microsoft IIS 5.0 relies only on Windows NT ACLs, so it fails to enforce NTLM or basic authentication. A remote attacker can therefore reach private web directories that are otherwise protected by those authentication mechanisms.
Description
The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated remote access to private web content with a CVSS 2.0 score of 10 and very high EPSS probability warrants immediate attention.
What it is
The hit-highlighting feature in webhits.dll on Microsoft IIS 5.0 relies only on Windows NT ACLs, so it fails to enforce NTLM or basic authentication. A remote attacker can therefore reach private web directories that are otherwise protected by those authentication mechanisms.
Impact
An attacker gains unauthenticated read access to web content in directories intended to be private, exposing files that authentication was meant to protect. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete, though the description only supports unauthorized access to private directories.
Attack surface
Reachable over the network by sending a request to null.htw with the CiWebhitsfile parameter; no authentication is required and no user interaction is indicated by the description or the AV:N/AC:L/Au:N vector.
Exploitation
Not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is very high at 0.7335 (99.4th percentile), indicating strong predicted exploitation activity.
What to do
- Apply the Microsoft fix referenced in KB 328832, or upgrade off IIS 5.0, which is long out of support.
- Disable or remove the webhits.dll hit-highlighting ISAPI extension if it is not required.
- Enforce authentication at the web server or application layer rather than relying solely on NTFS ACLs.
- Restrict network access to IIS 5.0 hosts and block requests to null.htw at the perimeter or WAF.
Detection
- Search web server logs for requests to null.htw, especially with a CiWebhitsfile parameter.
- Alert on access to private directories from unauthenticated sessions or unexpected source addresses.
- Baseline normal hit-highlighting usage and flag deviations in request volume or target paths.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-2815 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-2815), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
