Microsoft ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

A vulnerability exists in End of Life (EOL) versions of ASP.NET Core and Microsoft Visual Studio 2022, allowing unauthorized attackers to elevate privileges over the network. This issue arises from weak authentication, where the authentication mechanism fails to adequately verify user identities, enabling attackers to manipulate user sessions.

Impact

Exploitation of this vulnerability could allow an attacker to hijack an authenticated session and assume the identity of another user, gaining the privileges associated with that user.

Reproduction

To reproduce this vulnerability, set up an ASP.NET Core Identity project and create two user accounts. Authenticate as User A, then call the RefreshSignInAsync method with User B as the parameter. This will refresh the session to User B, exploiting the weak authentication flaw.

Remediation

Users can upgrade to ASP.NET Core Runtime versions 8.0.14 or 9.0.3, or to Microsoft.AspNetCore.Identity version 2.3.1. For applications deployed as self-contained, recompile and redeploy after upgrading. Additionally, users can leverage HeroDevs for post-EOL security support.