Microsoft ASP.NET Core 2.1/3.1 Security Feature Cookie privileges management

Summaryinfo

A vulnerability categorized as critical has been discovered in Microsoft ASP.NET Core 2.1/3.1. Affected is an unknown function of the component Security Feature. The manipulation as part of Cookie results in privileges management. This vulnerability is identified as CVE-2020-1045. The attack can be executed remotely. There is not any exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in Microsoft ASP.NET Core 2.1/3.1. Affected is an unknown functionality of the component Security Feature. The manipulation as part of a Cookie leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on integrity, and availability. CVE summarizes:

<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>

The weakness was released 09/08/2020 as confirmed security update guide (Website). The advisory is shared for download at portal.msrc.microsoft.com. The public release was coordinated with the vendor. This vulnerability is traded as CVE-2020-1045. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 02/24/2026). The MITRE ATT&CK project declares the attack technique as T1068. The advisory points out:

A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Microsoft

Name

• ASP.NET Core

Version

• 2.1
• 3.1

License

• open-source

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion