CVE-2020-1045
published 2020-09-11CVE-2020-1045: A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names. The ASP.NET Core cookie parser decodes entire…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
5.97%
92.5th percentile
A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.
The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.
The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| microsoft | asp.net_core | 2.1 – 2.1.21 | — |
| microsoft | asp.net_core | >= 3.1 < 3.1.8 | 3.1.8 |
| microsoft | asp.net_core_2.1 | >= 2.0 < publication | publication |
| microsoft | asp.net_core_3.1 | >= 3.0 < publication | publication |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm | >= 3.1.0 < 3.1.8 | 3.1.8 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm64 | >= 3.1.0 < 3.1.8 | 3.1.8 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm64 | >= 3.1.0 < 3.1.8 | 3.1.8 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-x64 | >= 3.1.0 < 3.1.8 | 3.1.8 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-x64 | >= 3.1.0 < 3.1.8 | 3.1.8 |
| microsoft | microsoft.aspnetcore.app.runtime.osx-x64 | >= 3.1.0 < 3.1.8 | 3.1.8 |
| microsoft | microsoft.aspnetcore.app.runtime.win-arm | >= 3.1.0 < 3.1.8 | 3.1.8 |
| microsoft | microsoft.aspnetcore.app.runtime.win-arm64 | >= 3.1.5 < 3.1.8 | 3.1.8 |
| microsoft | microsoft.aspnetcore.app.runtime.win-x64 | >= 3.1.0 < 3.1.8 | 3.1.8 |
| microsoft | microsoft.aspnetcore.app.runtime.win-x86 | >= 3.1.0 < 3.1.8 | 3.1.8 |
| msrc | asp.net_core_2.1 | — | — |
| msrc | asp.net_core_3.1 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_aus | — | — |
| redhat | enterprise_linux_aus | — | — |
| redhat | enterprise_linux_aus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft ASP.NET Core Security Feature Bypass Vulnerability
vendor_msrc·2020-09-08·CVSS 7.5
CVE-2020-1045 [HIGH] Microsoft ASP.NET Core Security Feature Bypass Vulnerability
Microsoft ASP.NET Core Security Feature Bypass Vulnerability
Description: A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.
The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.
The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.
ASP.NET: ASP.NET
Microsoft: Microsoft
Impact: Security Feature Bypass
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
Remediation: Release Notes
Reference: https://dotnet.microsoft.com/download/dotnet-core/2.1
Reference:
Red Hat
dotnet: ASP.NET cookie prefix spoofing vulnerability
vendor_redhat·2020-07-01·CVSS 7.5
CVE-2020-1045 [HIGH] CWE-807 dotnet: ASP.NET cookie prefix spoofing vulnerability
dotnet: ASP.NET cookie prefix spoofing vulnerability
A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.
The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.
The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.
A flaw was found in ASP.NET. Certain cookie values are not properly decoded allowing a remote attacker to bypass the "Cookie Prefixes" security mechanism. The highest threat from this vulnerability is to data integrity.
Statement: The "Cookie Prefixes" feature is not used by default in ASP.NET. Successful exploitation likely requires a secondary vulner
GHSA
Cookie parsing failure
ghsa·2022-05-24
CVE-2020-1045 [HIGH] Cookie parsing failure
Cookie parsing failure
A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names., aka 'Microsoft ASP.NET Core Security Feature Bypass Vulnerability'.
OSV
Cookie parsing failure
osv·2022-05-24
CVE-2020-1045 [HIGH] Cookie parsing failure
Cookie parsing failure
A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names., aka 'Microsoft ASP.NET Core Security Feature Bypass Vulnerability'.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-1045 dotnet: ASP.NET cookie prefix spoofing vulnerability
bugzilla·2020-08-28·CVSS 7.5
CVE-2020-1045 [HIGH] CVE-2020-1045 dotnet: ASP.NET cookie prefix spoofing vulnerability
CVE-2020-1045 dotnet: ASP.NET cookie prefix spoofing vulnerability
It was discovered that ASP.NET did not properly decode certain cookie values. A remote attacker could exploit this to bypass the "Cookie Prefixes" security mechanism by sending specially crafted cookies to a vulnerable web application.
Discussion:
Statement:
The "Cookie Prefixes" feature is not used by default in ASP.NET. Successful exploitation likely requires a secondary vulnerability, for example a cross-site scripting issue.
---
External References:
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1045
https://github.com/dotnet/aspnetcore/issues/23578
https://github.com/dotnet/aspnetcore/pull/24264
---
This issue has been addressed in the following products:
.NET Core on Red Hat Ente
Bugzilla
CVE-2018-10916 lftp: particular remote file names may lead to current working directory erased
bugzilla·2018-07-31·CVSS 5.3
CVE-2018-10916 [MEDIUM] CVE-2018-10916 lftp: particular remote file names may lead to current working directory erased
CVE-2018-10916 lftp: particular remote file names may lead to current working directory erased
Improperly sanitized remote file names in lftp, up to version 4.8.3, may lead to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim' system.
Reference:
https://github.com/lavv17/lftp/issues/452
Upstream patch:
https://github.com/lavv17/lftp/commit/a27e07d90a4608ceaf928b1babb27d4d803e1992
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2020:1045 https://access.redhat.com/errata/RHSA-2020:1045
---
This bug is now closed. Further upda
https://access.redhat.com/errata/RHSA-2020:3699https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.8/3.1.8.md#changes-in-318https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LN2FUVBSVPGK7AU3NMLO3YR6CGONQPB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ASICXQXS4M7MTAF6SGQMCLCA63DLCUT3/https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1045https://security.snyk.io/vuln/SNYK-RHEL8-DOTNET-1439600https://access.redhat.com/errata/RHSA-2020:3699https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.8/3.1.8.md#changes-in-318https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LN2FUVBSVPGK7AU3NMLO3YR6CGONQPB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ASICXQXS4M7MTAF6SGQMCLCA63DLCUT3/https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1045https://security.snyk.io/vuln/SNYK-RHEL8-DOTNET-1439600
2020-09-11
Published