Rapid7 Vulnerability & Exploit Database

NT IIS Double Byte Code Page Vulnerability

Back to Search

NT IIS Double Byte Code Page Vulnerability



This vulnerability could allow a web site viewer to obtain the source code for .asp and similar files if the server's default language (Input Locale) is set to Chinese, Japanese or Korean. How this works is as follows:

Request a URL of a known-good file that requires server processing, then append a hex value between x81 and xfe to the URL. For example:


If your server is vulnerable you will receive back the source code of your .asp file. IIS checks the extension of the requested file to see if it needs to do any processing before delivering the information. If the requested extension is not on its list, it then makes any language-based calculations, and delivers the file. If a single byte is appended to the end of the URL when IIS to set to use one of the double-byte language packs (Chinese, Japanese, or Korean) the language module will strip it as invalid, then look for the file. Since the new URL now points to a valid filename, and IIS has already determined that this transaction requires no processing, the file is simply delivered as is, exposing the source code.


  • install-microsoft-patch-e9e8b04b86c5439698e82fba45054656
  • install-microsoft-patch-cadcc79e26b4f7476ed53cceb6fb69a6

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center