Authentication Bypass by Spoofing Affecting microsoft.netcore.app package, versions [2.1.0,2.1.8) [2.2.0,2.2.2)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-MICROSOFTNETCOREAPP-173754
- published 6 Mar 2019
- disclosed 12 Feb 2019
- credit Jonathan Birch of Microsoft Corporation
Introduced: 12 Feb 2019
CVE-2019-0657 Open this link in a new tabHow to fix?
Upgrade Microsoft.NETCore.App to version 2.1.8, 2.2.2 or higher.
Overview
Microsoft.NETCore.App is a set of .NET API's that are included in the default .NET Core application model.
Affected versions of this package are vulnerable to Authentication Bypass by Spoofing due to the way they parse URL's. An attacker could use it to bypass security logic intended to ensure that a user-provided URL belonged to a specific hostname or a subdomain of that hostname. To exploit the vulnerability, an attacker must provide a URL string to an application that attempts to verify that the URL belongs to a specific hostname or to a subdomain of that hostname. The application must then make an HTTP request to the attacker-provided URL either directly or by sending a processed version of the attacker-provided URL to a web browser.