{"uuid": "e7eed883-55df-4238-ba70-c1b3056bb4c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Max\", \"Stefan Blair\", \"Axel Souchet\", \"Maurice LAMBERT \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits CVE-2021-31166, a UAF bug in http.sys\\n          when parsing specially crafted Accept-Encoding headers\\n          that was patched by Microsoft in May 2021, on vulnerable\\n          IIS servers. Successful exploitation will result in\\n          the target computer BSOD'ing before subsequently rebooting.\\n          Note that the target IIS server may or may not come back up,\\n          this depends on the target's settings as to whether IIS\\n          is configured to start on reboot.\", \"disclosure_date\": \"2021-05-11\", \"fullname\": \"auxiliary/dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166\", \"is_install_path\": true, \"mod_time\": \"2022-10-01 17:54:59 +0000\", \"name\": \"Windows IIS HTTP Protocol Stack DOS\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\", \"screen-effects\"], \"Stability\": [\"crash-os-restarts\"]}, \"path\": \"/modules/auxiliary/dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166\", \"references\": [\"CVE-2021-31166\", \"URL-https://nvd.nist.gov/vuln/detail/CVE-2021-31166\", \"URL-https://github.com/mauricelambert/CVE-2021-31166\", \"URL-https://twitter.com/metr0/status/1392631376592076805\", \"URL-https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31166\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:08.605281Z"}