Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is Double-Encoding still a security vulnerability on IIS6 as it was in IIS4/5?

share|improve this question
up vote 1 down vote accepted

The answer is yes and no, Strictly speaking, on the MS-API level, The issue has been rectified. Of course, if your application deals with encoding and requests paths that may not be contingent upon the URI provided - You're vulnerable and you're going to want to provide filtering AFTER any applicable encoding has been done.

share|improve this answer

What do you mean with Double-Encoding ? If it you talk about IIS Unicode Vulnerability (explained in , it's been resolved many years ago. IIS 6.0 is not vulnerable to this attack.

share|improve this answer

If you are talking about this kind of web application attack, then this is really most often due to a problem in the web application's code and not the web server behaviour. This particular issue is a problem on any and all web servers.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.