CVE-2010-3332
published 2010-09-22CVE-2010-3332: Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides…
PriorityP276medium6.4CVSS 2.0
AVNACLAuNCPIPAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
67.48%
99.2th percentile
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit targets ScriptResource.axd endpoint with manipulated 'd' parameter (modified ciphertext) to perform padding oracle / auto-decryptor attack; monitor for high-volume requests to /ScriptResource.axd?d= with varying 'd' values from a single source. ↗
- →Attacker uses HTTP response body length differences (not just HTTP status codes) to distinguish valid vs. invalid padding; detection should look for large numbers of near-identical requests to .axd resources with slight parameter variations. ↗
- →Exploit requests use 'Connection: Keep-Alive' header and the spoofed MSIE 8.0 User-Agent string; correlate these with repeated .axd requests as a detection signal. ↗
- →The padding oracle exploit encodes ciphertext using a custom Base64 variant ('+' replaced with '-', '/' replaced with '_', padding replaced with digit count); look for 'd=' parameter values matching [a-zA-Z0-9\-\_]+ followed by a digit in requests to .axd endpoints. ↗
- →The auto-decryptor exploit attempts to download Web.config by encoding '|||~/Web.config' as the target filename in the forged ciphertext; alert on HTTP 200 responses from .axd endpoints containing 'configuration' (Web.config content). ↗
- →Snort/VRT released rules on 2010-09-23 specifically covering CVE-2010-3332; apply those rule sets for network-level detection. ↗
- →Exploit checks for HTTP 200 responses and absence of 'parent.Sys.Application' string in body to confirm successful file retrieval; defenders can monitor for 200 responses to .axd requests that do NOT contain this string. ↗
- ·The padding oracle attack exploits detailed error responses from ASP.NET; the oracle distinguishes valid from invalid padding via differences in HTTP response body length rather than HTTP status codes alone, meaning HTTP-status-only detection is insufficient. ↗
- ·The auto-decryptor variant (MS10-070) uses a built-in ASP.NET decryptor rather than the classic padding oracle side-channel, meaning it may produce fewer anomalous requests and be harder to detect via volume-based heuristics alone. ↗
CVSS provenance
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vulncheck6.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-crcj-w6h9-q5f6: Microsoft
ghsa_unreviewed·2022-05-13
CVE-2010-3332 [MEDIUM] CWE-209 GHSA-crcj-w6h9-q5f6: Microsoft
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
VulnCheck
Microsoft .NET Framework Generation of Error Message Containing Sensitive Information
vulncheck·2010·CVSS 6.4
CVE-2010-3332 [MEDIUM] Microsoft .NET Framework Generation of Error Message Containing Sensitive Information
Microsoft .NET Framework Generation of Error Message Containing Sensitive Information
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
Affected: Microsoft .NET Framework
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://learn.microsoft.com/en-us/security-updates/Secur
No detection rules found.
Exploit-DB
Microsoft ASP.NET - Auto-Decryptor File Download (MS10-070)
exploitdb·2010-10-20
CVE-2010-3332 Microsoft ASP.NET - Auto-Decryptor File Download (MS10-070)
Microsoft ASP.NET - Auto-Decryptor File Download (MS10-070)
---
#!/usr/bin/ruby -w
#
# aspx_ad_chotext_attack.rb
#
# Copyright (c) 2010 AmpliaSECURITY. All rights reserved
#
# http://www.ampliasecurity.com
# Agustin Azubel - [email protected]
#
#
# MS10-070 ASPX proof of concept
# Decrypt data using an auto decryptor bundled in the aspx framework
# Encrypt data using Rizzo-Duong CBC-R technique
#
# Copyright (c) 2010 Amplia Security. All rights reserved.
#
# Unless you have express writen permission from the Copyright
# Holder, any use of or distribution of this software or portions of it,
# including, but not limited to, reimplementations, modifications and derived
# work of it, in either source code or any other form, as well as any other
# software using or referencing it in
Exploit-DB
Microsoft ASP.NET - Padding Oracle File Download (MS10-070)
exploitdb·2010-10-17
CVE-2010-3332 Microsoft ASP.NET - Padding Oracle File Download (MS10-070)
Microsoft ASP.NET - Padding Oracle File Download (MS10-070)
---
#!/usr/bin/ruby -w
#
# aspx_po_chotext_attack.rb
#
# Copyright (c) 2010 AmpliaSECURITY. All rights reserved
#
# http://www.ampliasecurity.com
# Agustin Azubel - [email protected]
#
#
# MS10-070 ASPX proof of concept
# Decrypt data using Vaudenay's cbc-padding-oracle-side-channel
# Encrypt data using Rizzo-Duong CBC-R technique
#
# Copyright (c) 2010 Amplia Security. All rights reserved.
#
# Unless you have express writen permission from the Copyright
# Holder, any use of or distribution of this software or portions of it,
# including, but not limited to, reimplementations, modifications and derived
# work of it, in either source code or any other form, as well as any other
# software using or referencing it in any
Exploit-DB
Microsoft ASP.NET - Padding Oracle (MS10-070)
exploitdb·2010-10-06
CVE-2010-3332 Microsoft ASP.NET - Padding Oracle (MS10-070)
Microsoft ASP.NET - Padding Oracle (MS10-070)
---
# Source: http://blog.mindedsecurity.com/2010/10/breaking-net-encryption-with-or-without.html
#!/usr/bin/perl
#
#
# Webconfig Bruter - exploit tool for downloading Web.config
#
# FOr use this script you need Pudbuster.
# Padbuster is a great tool and Brian Holyfield deserve all the credits.
# Note from Exploit-db: This very first exploit was meant to work with Padbusterdornet or Padbuster v0.2.
# A similar exploitation vector was also added lately in Padbuster v0.3:
# http://www.gdssecurity.com/l/b/2010/10/04/padbuster-v0-3-and-the-net-padding-oracle-attack/
# https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15213.pl (padBuster.pl)
#
#
# Giorgio Fedon - ([email protected])
#
use LWP::UserAge
Talos
Rule Release for Today, Thursday September 23rd, 2010
blogs_talos·2010-09-23·CVSS 6.4
CVE-2010-3332 [MEDIUM] Rule Release for Today, Thursday September 23rd, 2010
Microsoft .NET Framework Information Disclosure (CVE-2010-3332):
The Microsoft .NET Framework discloses enough information in error responses that an attacker is able to decrypt and modify encrypted data. The attacker is also able to forge cookies and obtain application files via an Oracle padding attack.
Get some: http://www.snort.org/vrt/advisories/2010/09/23/vrt-rules-2010-09-23.html
Talos
Rule Release for Today, Thursday September 23rd, 2010
blogs_talos·2010-09-23·CVSS 6.4
CVE-2010-3332 [MEDIUM] Rule Release for Today, Thursday September 23rd, 2010
## Rule Release for Today, Thursday September 23rd, 2010
Microsoft .NET Framework Information Disclosure (CVE-2010-3332): The Microsoft .NET Framework discloses enough information in error responses that an attacker is able to decrypt and modify encrypted data. The attacker is also able to forge cookies and obtain application files via an Oracle padding attack.
Get some: http://www.snort.org/vrt/advisories/2010/09/23/vrt-rules-2010-09-23.html
http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspxhttp://isc.sans.edu/diary.html?storyid=9568http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/http://secunia.com/advisories/41409http://securitytracker.com/id?1024459http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310http://twitter.com/thaidn/statuses/24832350146http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspxhttp://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspxhttp://www.ekoparty.org/juliano-rizzo-2010.phphttp://www.microsoft.com/technet/security/advisory/2416728.mspxhttp://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oraclehttp://www.securityfocus.com/bid/43316http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-securityhttp://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.htmlhttp://www.vupen.com/english/advisories/2010/2429http://www.vupen.com/english/advisories/2010/2751https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070https://exchange.xforce.ibmcloud.com/vulnerabilities/61898https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspxhttp://isc.sans.edu/diary.html?storyid=9568http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/http://secunia.com/advisories/41409http://securitytracker.com/id?1024459http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310http://twitter.com/thaidn/statuses/24832350146http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspxhttp://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspxhttp://www.ekoparty.org/juliano-rizzo-2010.phphttp://www.microsoft.com/technet/security/advisory/2416728.mspxhttp://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oraclehttp://www.securityfocus.com/bid/43316http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-securityhttp://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.htmlhttp://www.vupen.com/english/advisories/2010/2429http://www.vupen.com/english/advisories/2010/2751https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070https://exchange.xforce.ibmcloud.com/vulnerabilities/61898https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365
2010-09-22
Published
Exploited in the wild