Approved: Fortect
If you have HTTP error 502.2 Bad Gateway iis7 on your system, we hope this user guide can help you fix it.
- 5 minutes to read.
Tools used in this patch:
- Tracker in IIS 7.X
- Tracing Windows Event Tracing in IIS 6.0
- Microsoft Network Monitor 3 Hardware 4
they are for informational purposes only. Microsoft usually makes warranties, either express or implied.
Presentation
You have a definitionThis is a website hosted on the Internet when Information Services (IIS) 7.0. When viewing a website in a web browser, you may receive an error message that resembles the following:
Server error in application "application name"HTTP Error 502.2 - GatewayHRESULT: invalid 0xC00000FD or 0x00000003Description HRESULT: The specified CGI application did not return a complete HTTP header match.
This issue occurs because the main CGI process exits unexpectedly before the CGI process returns a response on IIS 7.0
Troubleshooting
Scenario: When submitting a request to their CGI application running on IIS, an attacker would preferably see the following error instead of the expected response:
"The specified CGI application behaved badly because it did not return any forwarding of certain HTTP headers."
Approved: Fortect
Fortect is the world's most popular and effective PC repair tool. It is trusted by millions of people to keep their systems running fast, smooth, and error-free. With its simple user interface and powerful scanning engine, Fortect quickly finds and fixes a broad range of Windows problems - from system instability and security issues to memory management and performance bottlenecks.
HTTP: client response; HTTP / 1.1; Status Code 502 Compliant - Bad GatewayHTTP: protocol version = HTTP / 1.1HTTP: status code = bad gatewayHTTP: = gateway for good reasonHTTP: content length = 232Http: content type = text / htmlHTTP: Server = Microsoft-IIS / 6.0HTTP: Date = Tue, 23 aAug 2005 20:25:47 Dates: gmthttp: number of data bytes remaining = 232 (0x00E8)00000: Double zero 11 BC 3E 62 3C Double zero 0F 1F 6C 1F E1 08 50 45 00 .. ¼> b <... l.á..E.00010: 01 9A EF 20 40 00 80 06 00 00 D8 10 a2 5C 0A C8 .šï @@. ‚¬ ... ˜ ¢. . TO00020: spring 15 00 50 55 AA b1 C6 89 52 E7 D6 85 01 fifty percent 18 ... PU ± ªÃ † â € ° Rçà - â € ¦.P.0900030: 2F F9 67 double zero 00 48 54 54 50 2F 29 2E 31 20 35 ./¹g..HTTP/1.1 500040: 25 32 20 42 61 64 20 46 61 74 77 65 61 seventy nine 0D 0A 02 Bad gateway ..00050: 43 6E 6f seventy four 65 6E 74 2D 4C 5 6E 67 74 68 3A 20 Content length:00060: 32 33 32 0D 0A forty three 6E 6f 74 65 6E 74 2. 54 79 70 232..Content-Typ00070: 65 3A twenty five 74 65 74 78 2F 68 seventy four 6D 6C 0D 0A 53 65 ation: text / html..Se00080: 72 76 65 72 3A about twenty 4D 69 63 72 73 6f 6F sixty six 74 2D rver: Microsoft-00090: 49 forty nine 53 2F 36 2E 30 0D 0A 42 61 74 65 3A 20 fifty four IIS / 6.0 .. Date: T000A0: 75 65 2C 20 thirty three 32 20 41 75 67 20 36 30 30 35 20 eu, 23 August 2005000B0: 32 30 3A 32 27 3A 34 37 20 47 4D fifty four 0D 0A 0D 0A 20:25:47 GMT ....000C0: 3C 68 74 6D 6C 3E 3C forty eight 68 61 64 3E 3C 74 sixty nine 74 error 000E0: 3C 2F over 60 68 61 64 3E 3C sixty two 6F 64 79 3E 3C 65 sixty eight error 00100: sixNinety 6E 20 43 47 49 20 41 seventy 70 6C 69 63 61 74 sixty nine in CGI applications00110: 6F 6E 3C 2F seventy-four 69 74 6C 65 3E 3C 2F 65 68 61 64 on . Graphics00130: 45 72 Seventy Two 6F 72 3C 2F 68 31 3E Fifty Four 68 65 20 73 70 Error
Sp00140: 65 63 69 69 66 65 sixty four 20 43 47 49 20 61 74 70 CGI application certified 6C00150: 69 sixty three 61 74 69 6F 6E twenty years 6D 69 73 62 65 68 61 seventy six00160: 65 64 20 62 seventy nine 20 6E 6F 74 20 72 55 74 75 72 6E ed by not just return00 170: 69 6E 67 20 61 approx. 63 6F 6D 70 6C 65 seventy four 65 20 73 ing un p all inclusive00180: 65 74 20 6F 66 20 24 54 54 50 20 68 65 sixty one 64 65 and HTTP headers00190: seventy two 73 2E 3C 2F 62 6F sixty four 79 3E 3C 2F 62 6F sixty four 79 rs.
Save the log as an HTTP error message and find out which module is generating the error message.
Troubleshoot the CGI process executable to determine that the CGI process exited unexpectedly. You will most likely need to create a CGI process dump register when connecting to a violation. https://support.microsoft.com/?id=150835
This issue occurs when the CGI application does exactly what the error suggests: inserts invalid data into the HTTP header values sent to IIS as part of its response. In IIS 6 with Windows 2003 SP1 installed, you can use Enterprise Tracing for Windows (ETW tracing) to see exactly what the computer is returning.
-
Copy the ETWSetup.File attached to our email to the IIS6 server.
-
Check it out on the server.
-
Open it from the purchase requisition folder.
-
Enter iis6trace-start.cmd to start tracing.
-
Reproduce the problem.
-
Enter iis6trace-stop.cmd to stop tracing.
-
In the previous paragraph, we should have had an iistrace_etl.etl track in this folder.
-
Compress this statement and send it to the Microsoft support engineer.
A support specialist can help you convert ETL documents to XML.
-
Here is an example file for this type of CGI issue:
391 IISGeneral GENERAL_REQUEST_START 08/23/2005 20:19:06 ContextId = 00000000-0000-0000-4c06-0060000000ef | SiteId = 1 | AppPoolId = DefaultAppPool | ConnId = -1224979097571031481 | RawConnId = 0 | RequestURL = http: //btdatashare.btboces.org: 80 / cgi-bin / htmlos.exe / 00182.3.
name = "Main"> 405 IISCGI CGI_LAUNCH 08/23/2005 20:19:07 ContextId = 00000000-0000-0000-4c06-0060000000ef | CommandLine = "D: Inetpub cgi-bin htmlos.exe" | ErrorCode = 0x00000000 | ProcessId = 3136 |
441 IISCGI CGI_PREMATURE_TERMINATION 08/23/2005 08:25:47 PM ContextId = 00000000-0000-0000-4c06-006000000ef | Headers =
Line 446 then tells ours that 502 is being sent to clients. This is indeed 502.2 (sub-status of all 2):
446 IISGeneral GENERAL_REQUEST_END 08/23/2005 08:25:47 PM ContextId = 00000000-0000-0000-4c06-0060000000ef | BytesSent = 370 | BytesReceived = 105906875 | HttpStatus = 502 | HttpSubStatus = 2
The request is being processed by IIS, we see that it is a CGI and forward it to your CGI. The CGI starts processing around line 405:
