WebDAV Remote Code Execution

Description

WebDAV is enabled on this server and this directory has write permissions enabled. Acunetix WVS was able to create a test file within this directory using the PUT method. The PUT method is a part of the WebDAV standard for remote content editing. A poorly configured Web server can mistakenly provide remote access to the PUT method without requiring any form of login. Even more, the scanner was able to rename this file to filename.asp;.jpg and then execute code in the context of the web server.

ShareShare on FacebookTweet about this on TwitterShare on Google+

Impact
Malicious users can execute arbitrary code on this system. Possible system compromise.

Recommendation
Remove write permissions from this directory or disable WebDAV if it's not being used.

References
W3C - RFC 2616
How to disable WebDAV for IIS 5.x