CVE-2020-0645: Microsoft IIS Server Tampering Vulnerability

CVE-2020-0645 Overview

A tampering vulnerability exists when Microsoft IIS Server improperly handles malformed request headers. This vulnerability, officially designated as the 'Microsoft IIS Server Tampering Vulnerability,' allows remote attackers to bypass security controls and manipulate server behavior through specially crafted HTTP requests. Organizations running IIS on affected Windows operating systems should prioritize patching to prevent potential tampering attacks.

Critical Impact

Remote attackers can exploit improper request header handling in Microsoft IIS Server to tamper with web server functionality without requiring authentication, potentially leading to unauthorized data modification or security bypass.

Affected Products

• Microsoft Windows 10 (multiple versions including 1607, 1709, 1803, 1809, 1903, 1909)
• Microsoft Windows 7 SP1
• Microsoft Windows 8.1
• Microsoft Windows RT 8.1
• Microsoft Windows Server 2008 (SP1 and R2 SP1)
• Microsoft Windows Server 2012 (including R2)
• Microsoft Windows Server 2016 (including versions 1803, 1903, 1909)
• Microsoft Windows Server 2019

Discovery Timeline

• March 12, 2020 - CVE-2020-0645 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-0645

Vulnerability Analysis

This tampering vulnerability affects the HTTP request header parsing mechanism within Microsoft Internet Information Services (IIS). When IIS receives HTTP requests with malformed or specially crafted headers, the server fails to properly validate and handle these inputs. This improper handling can allow attackers to manipulate how the server processes requests, potentially bypassing security controls, modifying cached content, or influencing downstream application behavior.

The vulnerability is particularly concerning because it can be exploited remotely over the network without requiring any user interaction or prior authentication. The primary impact is on data integrity, as attackers can potentially tamper with server responses or internal processing logic.

Root Cause

The root cause lies in insufficient validation of HTTP request headers within the IIS web server component. When malformed headers are received, IIS does not adequately sanitize or reject these inputs, allowing attackers to inject unexpected values that influence server behavior. This falls under the category of improper input validation, specifically related to HTTP protocol handling.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker can craft malicious HTTP requests containing malformed headers and send them to a vulnerable IIS server. The exploitation requires no user interaction and can be performed by any network-accessible attacker.

The attack typically involves:

1. Identifying a target IIS server running on an affected Windows version
2. Crafting HTTP requests with specially malformed or manipulated headers
3. Sending these requests to the server to trigger the improper handling behavior
4. Exploiting the resulting tampering condition to modify server behavior or bypass security controls

This vulnerability could be chained with other attacks to achieve more significant impact, such as cache poisoning or request smuggling scenarios.

Detection Methods for CVE-2020-0645

Indicators of Compromise

• Unusual or malformed HTTP request headers in IIS access logs with unexpected characters or encoding
• HTTP requests containing abnormally long or duplicated header values
• Suspicious patterns in request headers that deviate from standard HTTP specifications
• Evidence of HTTP request smuggling or cache poisoning attempts in web server logs

Detection Strategies

• Enable detailed IIS logging and monitor for requests with malformed or suspicious header patterns
• Deploy web application firewalls (WAF) configured to detect and block malformed HTTP headers
• Implement intrusion detection rules that flag non-compliant HTTP request structures
• Use SentinelOne's network visibility capabilities to identify anomalous HTTP traffic patterns targeting IIS servers

Monitoring Recommendations

• Configure IIS Failed Request Tracing to capture detailed information on suspicious requests
• Set up alerts for high volumes of malformed requests from single source IPs
• Monitor for exploitation attempts using SIEM correlation rules focused on HTTP header anomalies
• Implement baseline monitoring for normal IIS request patterns to detect deviations

How to Mitigate CVE-2020-0645

Immediate Actions Required

• Apply the Microsoft security update from the March 2020 Patch Tuesday release immediately
• Audit all IIS servers in the environment to identify affected systems running vulnerable Windows versions
• Implement network segmentation to limit exposure of IIS servers to untrusted networks
• Enable request filtering in IIS to reject requests with malformed headers as a temporary measure

Patch Information

Microsoft has released security updates to address this vulnerability as part of the March 2020 security updates. The patch corrects how IIS handles malformed request headers, ensuring proper validation and rejection of non-compliant inputs. For detailed patch information and download links, refer to the Microsoft Security Advisory for CVE-2020-0645.

Organizations should prioritize patching production IIS servers, especially those exposed to the internet or untrusted networks. The security update is available through Windows Update, Windows Server Update Services (WSUS), and the Microsoft Update Catalog.

Workarounds

• Enable IIS Request Filtering to block requests with suspicious header patterns or excessive header lengths
• Deploy a reverse proxy or WAF in front of IIS servers to sanitize incoming HTTP requests
• Configure maxAllowedContentLength and header size limits in IIS to restrict malformed input
• Restrict network access to IIS servers using firewall rules to limit exposure to trusted sources only

# IIS Request Filtering Configuration via PowerShell
# Limit request header size to help mitigate malformed header attacks
Import-Module WebAdministration

# Set maximum allowed header length (in bytes)
Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter "system.webServer/security/requestFiltering/requestLimits" -Name "maxAllowedContentLength" -Value 30000000

# Enable request filtering module
Add-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter "system.webServer/security/requestFiltering/headerLimits" -Name "." -Value @{header='Content-Type';sizeLimit=1024}

# Verify configuration
Get-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter "system.webServer/security/requestFiltering/requestLimits" -Name "maxAllowedContentLength"