GHSA-9mv3-2cwr-p262

Executive Summary:

A bug in Microsoft.AspNetCore.DataProtection 10.0.0-10.0.6 NuGet packages can give an attacker the opportunity to execute an Elevation of Privilege attack by forging authentication cookies, and also allows some protected payloads to be decrypted.

If an attacker used forged payloads to authenticate as a privileged user during the vulnerable window, they may have induced the application to issue legitimately-signed tokens (session refresh, API key, password reset link, etc.) to themselves. Those tokens remain valid after upgrading to 10.0.7 unless the DataProtection key ring is rotated.

This is comparable in capability to MS10-070, which exploited a similar padding-oracle condition in ASP.NET's legacy encryption infrastructure.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/395

CVSS Details

• Version: 3.1
• Severity: Important
• Score: 9.1
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Weakness: CWE-347: Improper Verification of Cryptographic Signature

Affected Platforms

• Platforms: All
• Architectures: All

<a name="affected-packages"></a>Affected Packages

The vulnerability affects some Microsoft .NET projects if they use any of affected package versions listed below

<a name="ASP.NET Core 10"></a>ASP.NET Core 10

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.DataProtection | >=10.0.0, <=10.0.6 | 10.0.7

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Primary affected configuration (10.0.6 on net10.0)

You are affected if ALL of the following are true:

• Your application referenced Microsoft.AspNetCore.DataProtection...