Attention! New .NET Vulnerabilities

4min read

Image of dark room with an open door. Label on the left saying 'Vulnerabilities .NET'

Greetings App Sec community! Meterian is back with some .NET vulnerabilities which need some attention. Both these vulnerabilities are of a medium to high threat nature, so make sure to give this a read, it’ll be worth your while. The first case deals with a cross-site scripting vulnerability, whilst the second can cause a core denial of service issue. Don’t let hackers use this as a backdoor to your systems and networks. Stay protected people!

  • CVE-2019-1301: .NET Core suffers from a denial of service vulnerability when it improperly handles web requests.
  • CVE-2019-12562: There is stored cross-site scripting vulnerability in DotNetNuke (DNN) versions before 9.4.0, allowing attackers to store and embed malicious script into the administration notification page.

CVE-2019-1301

Vulnerability Score: 7.5/HIGH

Platform: .NET

Components: 

Affected Versions: 

  • .NET Core  / Microsoft.NetCore.App: 2.1.0-2.1.12 or 2.2.0-2.2.6
  • System.Net.Sockets: 4.3.0

The first .NET vulnerability we bring to your urgent attention is a denial of service vulnerability which occurs when .NET Core improperly handles web requests. The affected versions are in any .NET Core based application running on .NET Core 2.1.0 to 2.1.12 or 2.2.0 to 2.2.6, and System.Net.Sockets 4.3.0. This is regarded as a high threat to security and should be tended to immediately.

How can you confirm if your .NET application is affected? Run the dotnet –info command to see the list of the versions you have installed. You will then see output as shown below:

Lines of code which show the if your .NET application is affected.
https://github.com/dotnet/announcements/issues/121

If you see that you have a version of .NET Core which is less than 2.1.13 or less than 2.2.7, then unfortunately you are vulnerable. The same applies if you are using the meta-package “Microsoft.NETCore.App”, with the same version range. Please note that this also applies to the package System.Net.Sockets version 4.3.0.

What is .NET Core? It is an open source, development platform which is maintained by Microsoft and the .NET community on GitHub. It can be used to build device, cloud and IoT applications. 

Why is this vulnerability such a threat? Firstly, the attacker who is successful in the exploit of this vulnerability would use the denial of service against the .NET Core web application. Not only can this vulnerability be exploited remotely, but also without authentication of the user-cum-attacker. A denial of service attack (DoS) is focused on making a resource unavailable for the purpose of its design. The unavailability of a resource can come in many forms: manipulating network packets, programming, logical or resource handling vulnerabilities. Sometimes the attacker may execute arbitrary code to access critical information or execute commands on the server. Generally, this type of attack would cause response delays, large-scale losses, interruption to services and therefore an impact on availability. 

So how can you fix this issue? It is recommended to install the latest version of .NET Core but it depends on the versions which you have already installed. You may need to update if you have either version 2.1 (upgrade at least to 2.1.13) or 2.2 (upgrade at least to 2.2.7). If you are using the meta-package, upgrade the meta-package following the same version numbering. Also, if you are using System.Net.Sockets, please upgrade to version 4.3.1

CVE-2019-12562

Vulnerability Score: 6.1/MEDIUM

Platform: .NET

Component: DotNetNuke

Affected Versions: up to 9.4.0

You read right.  DotNetNuke (DNN) has a cross-site scripting vulnerability before versions 9.4.0 which is allowing remote attackers to store and embed malicious script into the admin notification page. The success of this exploit occurs when an admin user visits a notification page with stored cross-site scripting. 

A little information on DNN. First of all, it is a program that runs on Microsoft ASP.NET. It is also a framework, meaning it is a program designed to be extended. When you install DNN it can allow the creation of thousands of individual portals. These portals can then display pages and the pages display modules. More importantly, DNN is an open source web content management system meaning many businesses around the world rely on it for organisational purposes. DNNSoftware.com has over 1million registered members since 2013 and is used on nearly 750,000 websites globally. This might illuminate how many people could be affected by this vulnerability and why this needs urgent attention to avoid getting hacked.

The severity of this vulnerability is emphasized through the fact that stored cross site-scripting is the most dangerous type of cross-site scripting. The exploit could be used to perform any action that has administrator privileges. This includes: managing content, adding users, uploading backdoors to the server and more. 

Once this vulnerability had been detected it was reported to the DNN Software Security Department who have fixed the problem and released a patch. Users should update to the latest version 9.4.0 of DNN to avoid any security holes within their systems and networks. 

That is it from us…for now! Make sure to spread the word on these .NET vulnerabilities in order to help protect your apps or the apps you develop. But as you all know, open-source vulnerabilities are discovered daily, so you can expect us to be back with new vulnerabilities very soon!

Knowing is half the battle. The other half is doing. Let Meterian help your dev team stay in the know and on top of the latest updates to secure your apps continuously.  Sign up here to download the Meterian client today.  You’ll get an instant analysis of your first project for free.  See the risks immediately and know which components to remove or upgrade to secure your app.

Attention! New .NET Vulnerabilities

Vulnerability Focus: .NET

Image of thief climbing out of laptop shining flashlight on .net icon, titled Vulnerability Focus: .NET

In the wake of the massive Capital One data breach incited by a misconfigured web app firewall, we are throwing in a .NET open source library vulnerability that demonstrates the pervasiveness of privilege escalation attacks across web apps for good measure.

CVE-2019-1010199

Vulnerability Score: Medium — 6.1 (CVSS v3.0)

Platform: .NET 

Component: ServiceStack 

Affected versions: 4.5.14

It is a perilous time for ServiceStack users, a widely-used .NET based library.
The problem lies with the ServiceStack ecosystem, where a JavaScript-based Cross-Site Scripting (XSS) vulnerability could allow attackers to inject client-side code or scripts into web browsers viewed by other users. This means that said script is activated when it is read by an unsuspecting user’s web browser or web application. The web page or application then acts as an attack vector that delivers the malicious script to the user’s browser.

A web page or application is made vulnerable to XSS if it executes unsanitized user input for web servers to generate output – this user input must then be parsed by the victim’s browser to potentially compromise the system. We will note that though XSS attacks are possible across many languages (e.g. VBScript, ActiveX, Flash, CSS), they are, however, most common in JavaScript (as with this vulnerability) as this language is most commonly used as a client-side scripting language to support a bulk of web browsing experiences. 

In the context of this vulnerability within ServiceStack Framework 4.5.14, the flawed component is the query code used to execute the GET request. And with the web browser’s lack of server-side validation serving as the attack vector, this means that browser encoding is bypassed which could then compromise unsuspecting users’ browsers upon opening a crafted URL. The resulting impact is that a potentially malicious JavaScript code (aka unsanitized user input) would be reflected in the server response during execution for web browser output generation.

Such cross-site scripting vulnerabilities are often used by attackers for privilege escalation issues, especially to bypass access controls when two web pages are of the same origin (i.e. two URLs sharing the same protocol, port (if specified), and host).

This unauthorised access could then lead to security breaches such as data theft and password dumping. It is thus imperative that affected frameworks immediately download the patched version in 5.2 or later to avoid sensitive data violations.

With JavaScript being a key programming language that supports web development, it is imperative that we keep our guard up against unwanted intrusions to ensure seamless and secure provision of web services. We certainly hope this detailed analysis of this .NET vulnerability has galvanized you into taking active measures to avoid systemic data breaches. Until next time!

Sign up here to download the Meterian client today. You’ll get an instant analysis of your first project for free.  See the risks immediately and know which components to remove or upgrade to secure your app.

Vulnerability Focus: .NET