.NET Core Tampering Vulnerability Allowing Arbitrary File Writing

A tampering vulnerability has been identified in .NET Core, where the framework improperly manages specially crafted files. This vulnerability allows an attacker to write arbitrary files and directories to specific locations on a vulnerable system. However, the attacker would have limited control over where these files and directories are placed. To exploit this vulnerability, an attacker must send a specially crafted file to the affected system.

Impact

Exploitation of this vulnerability could lead to unauthorized file and directory writing on the affected system, potentially allowing for further manipulation or misuse of the system.

Remediation

Users can download the security update for .NET 9.0, .NET 8.0, .NET 10.0, and various versions of Microsoft Visual Studio from the Microsoft Visual Studio Update Center. Instructions for downloading the security update for each product are available on the Microsoft Support website.