CVE-2021-34532: Microsoft ASP.NET Core information disclosure in JwtBearer authentication

CVE-2021-34532 · Severity: medium · CVSS 5.5 · Published 2021-08-25

A security vulnerability exists in Microsoft .NET and ASP.NET Core, which are frameworks used to build and run web applications. The issue occurs when the system fails to process a security token (JWT) and inadvertently records the full token into system logs. If an unauthorized person gains access to these logs, they could use the captured tokens to impersonate legitimate users and access sensitive data.

Technologies: Microsoft .NET Core. Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2021-34532 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-34532 being exploited in the wild.
How severe is CVE-2021-34532?
Medium severity, with a CVSS score of 5.5, published 25 August 2021.
Which products and versions are affected?
Microsoft .NET Core 3.1, < 3.1.18; 2.1, < 2.1.29; Microsoft AspNetCore.Authentication.JwtBearer >= 2.1.0, < 2.1.29; >= 3.0.0, < 3.1.18; >= 5.0.0, < 5.0.9; Microsoft.AspNetCore.Authentication.JwtBearer (NuGet) ECOSYSTEM:introduced=2.1.0,fixed=2.1.29.
Is there a fix for CVE-2021-34532?
Yes. Microsoft.AspNetCore.Authentication.JwtBearer (NuGet): upgrade to 2.1.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-34532 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2021-34532?
Check whether you run Microsoft .NET Core, Microsoft AspNetCore.Authentication.JwtBearer or Microsoft.AspNetCore.Authentication.JwtBearer (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.AspNetCore.Authentication.JwtBearer (NuGet): upgrade to 2.1.29 or later
    dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer --version 2.1.29

Technical details

An information disclosure vulnerability exists in the Microsoft.AspNetCore.Authentication.JwtBearer package within .NET 5.0, .NET Core 3.1, and .NET Core 2.1. The root cause is improper handling of failed JWT parsing, which results in the entire token being written to application logs. An attacker with local access to the system logs could retrieve these tokens to bypass authentication or escalate privileges. The vulnerability is triggered when a malformed or unparseable token is submitted to an affected application. Microsoft has released patches in .NET 5.0.9, .NET Core 3.1.18, and .NET Core 2.1.29 to address this behavior.

Affected products

  • Microsoft .NET 5.0, < 5.0.9
  • Microsoft .NET Core 3.1, < 3.1.18; 2.1, < 2.1.29
  • Microsoft Microsoft.AspNetCore.Authentication.JwtBearer >= 2.1.0, < 2.1.29; >= 3.0.0, < 3.1.18; >= 5.0.0, < 5.0.9

Identifiers

  • CVE-2021-34532
  • GHSA-q7cg-43mg-qp69

Timeline

  • 2021-08-10: disclosed
  • 2021-08-10: patched
  • 2021-08-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.