Executive brief
A security vulnerability exists in Microsoft .NET and ASP.NET Core, which are frameworks used to build and run web applications. The issue occurs when the system fails to process a security token (JWT) and inadvertently records the full token into system logs. If an unauthorized person gains access to these logs, they could use the captured tokens to impersonate legitimate users and access sensitive data.
Technical details
An information disclosure vulnerability exists in the Microsoft.AspNetCore.Authentication.JwtBearer package within .NET 5.0, .NET Core 3.1, and .NET Core 2.1. The root cause is improper handling of failed JWT parsing, which results in the entire token being written to application logs. An attacker with local access to the system logs could retrieve these tokens to bypass authentication or escalate privileges. The vulnerability is triggered when a malformed or unparseable token is submitted to an affected application. Microsoft has released patches in .NET 5.0.9, .NET Core 3.1.18, and .NET Core 2.1.29 to address this behavior.
Affected products
- Microsoft .NET 5.0, < 5.0.9
- Microsoft .NET Core 3.1, < 3.1.18; 2.1, < 2.1.29
- Microsoft Microsoft.AspNetCore.Authentication.JwtBearer >= 2.1.0, < 2.1.29; >= 3.0.0, < 3.1.18; >= 5.0.0, < 5.0.9
Timeline
- 2021-08-10: disclosed
- 2021-08-10: patched
- 2021-08-25: advisory
References
- https://github.com/dotnet/aspnetcore/security/advisories/GHSA-q7cg-43mg-qp69
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34532
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34532
- https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-q7cg-43mg-qp69