Microsoft .NET Framework up to 4.8 xml injection

Summaryinfo

A vulnerability classified as critical was found in Microsoft .NET Framework up to 4.8. This vulnerability affects unknown code. Executing a manipulation can lead to input validation. The identification of this vulnerability is CVE-2020-0646. The attack may be launched remotely. Furthermore, there is an exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Microsoft .NET Framework up to 4.8 (Programming Language Software). It has been declared as critical. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-91. The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

The weakness was shared 01/14/2020 as confirmed security update guide (Website). The advisory is shared for download at portal.msrc.microsoft.com. The vendor cooperated in the coordination of the public release. This vulnerability was named CVE-2020-0646. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1505. The advisory points out:

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

A public exploit has been developed by Soroush Dalili in HTTP POST Request and been published before and not just after the advisory. It is possible to download the exploit at mdsec.co.uk. It is declared as attacked. The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $5k-$25k. This issue was added on 11/03/2021 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 05/03/2022:

Apply updates per vendor instructions.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (48275). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Language Software

Vendor

• Microsoft

Name

• .NET Framework

Version

• 3.0 SP2
• 3.5
• 3.5.1
• 4.5.2
• 4.6
• 4.6.1
• 4.6.2
• 4.7
• 4.7.1
• 4.7.2
• 4.8

License

• free

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion