Description
Microsoft Security Advisory CVE-2021-43877 | ASP.NET Core Elevation of privilege Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET and .NET Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
An elevation of privilege vulnerability exists in ANCM which could allow elevation of privilege when .NET core, .NET 5 and .NET 6 applications are hosted within IIS.
Discussion
Discussion for this issue can be found at dotnet/aspnetcore#39028
Mitigation factors
Only applications hosted under IIS are vulnerable. If you use Kestrel as your web hosts you are not vulnerable.
Affected software
-
Any .NET 6.0 application hosted in IIS running on ANCM version 16.0.21299.0
-
Any .NET 5.0 application hosted in IIS running on ANCM version 15.0.21297.12 or lower
-
Any .NET Core 3.1 application hosted in IIS running on ANCM version 13.1.21296.21 or lower
You can check the ANCM version of the affected binary aspnetcorev2_inprocess.dll from "C:\Program Files\IIS\Asp.Net Core Module\V2"
How do I know if I am affected?
If you have a hosting bundle of a version listed in affected software, you're exposed to the vulnerability.
How do I fix the issue?
To fix the issue, please install the latest version of hosting bundle.
-
If you're using .NET 6.0, you should download and install the .NET 6.0.1 hosting bundle from https://dotnet.microsoft.com/download/dotnet-core/6.0.
-
If you're using .NET 5.0, you should download and install the .NET 5.0.13 hosting bundle from https://dotnet.microsoft.com/download/dotnet-core/5.0.
-
If you're using .NET Core 3.1, you should download and install .NET Core 3.1.22 from https://dotnet.microsoft.com/download/dotnet-core/3.1.
.NET 6.0, .NET 5.0 and, .NET Core 3.1 updates are also available from Microsoft Update. To access this either type "Check for updates" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.
Once you have installed the updated hosting bundle, restart your apps for the update to take effect.
Other Information
Reporting Security Issues
If you have found a potential security issue in .NET, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.
Support
You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at dotnet/runtime and dotnet/aspnet. The Announcements repo will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.
Disclaimer
The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
External Links
Revisions
V1.0 (December 14, 2021): Advisory published.
Version 1.0
Last Updated 2021-12-14