Developers using ASP.NET Core are being urged to check their applications after Microsoft disclosed a serious security flaw introduced in a recent update. The issue was caused by an unintended regression in the Data Protection Library, which is used to secure cookies, tokens, and other sensitive data. This bug affects many systems, including Linux, macOS, and Windows, especially those using custom cryptographic settings.

What’s the Problem with the Latest Update

The problem stems from a bug in the .NET 10.0.6 package, released as part of the April 14 Patch Tuesday updates. This bug causes the ManagedAuthenticatedEncryptor library to calculate security hashes incorrectly. Specifically, it uses the wrong offset when computing validation tags for HMAC, a key component in ensuring data integrity and authenticity. As a result, some cookies and tokens previously considered trustworthy might now be invalid or, worse, falsely accepted.

This flaw can allow attackers to forge payloads or decrypt protected data in cookies, anti-forgery tokens, and other security tokens. Essentially, malicious actors could manipulate these tokens to impersonate users or gain unauthorized access to sensitive parts of an application. Microsoft’s advisory warns that this vulnerability could be exploited during the window when the bug remains unpatched, putting many applications at risk.

The Severity and Historical Context

Microsoft rates this vulnerability as CVSS 9.1, meaning it’s highly critical. The company compares it to previous major flaws, including the notorious MS10-070 patch from 2010, which addressed a serious cryptographic vulnerability in Windows. This comparison highlights how dangerous this problem could be if exploited in the wild.

This issue comes just six months after another major security flaw in ASP.NET, rated CVSS 9.9, was discovered in the Kestrel web server component. The recurrence of such vulnerabilities underlines the importance of timely updates and thorough testing. Developers are advised to act quickly to mitigate potential risks.

What Developers Need to Do

Typically, when a flaw like this is found, the solution is straightforward: update the software. Microsoft has already released a patched version (10.0.7) that addresses this specific issue. For server environments, the update should automatically be applied, but developers working with Docker containers or embedded applications might need to take extra steps.

For those using ASP.NET Core in custom applications, it’s important to rebuild and redeploy any projects created after the April 14 update. This includes applications targeting older frameworks like netstandard2.0 or net462, which may still rely on the flawed NuGet package. Ensuring all components are updated and rebuilt is essential to close the security gap.

Developers should also review their security configurations, especially if they have enabled custom cryptographic algorithms via APIs like UseCustomCryptographicAlgorithms. Staying vigilant and applying the latest patches will help protect applications from potential exploitation.

In summary, this vulnerability highlights the need for regular updates and careful review of cryptographic implementations within applications. While the fix is available, proactive measures remain crucial to maintaining security integrity across all deployments.

Inspired by

• https://www.infoworld.com/article/4162194/microsoft-issues-out-of-band-patch-for-critical-security-flaw-in-update-to-asp-net-core-2.html

Sources

• nist.gov
• github.com
• csoonline.com
• microsoft.com
• microsoft.com