Executive brief
CoreWCF is a tool used by developers to build web services on modern .NET platforms. A security flaw in its message verification system allows an attacker to capture a legitimate, signed message and reuse it to perform unauthorized actions as if they were the original user. This could lead to unauthorized data access or the execution of sensitive business operations without proper permission.
Technical details
A vulnerability exists in CoreWCF's WS-Security implementation where endorsing and supporting signature verification does not properly validate that the 'ds:Signature' element covers the intended Security header target. Specifically, the 'ReadSignatureCore' and 'VerifySignatureAsync' functions failed to strictly bind signature lookups to the Security header subtree, allowing an attacker to 'steer' the receiver into validating a smuggled signature from a sibling header. By capturing a single signed SOAP envelope, a remote attacker can replay arbitrary service operations as the victim principal. The fix introduces 'FindSecurityHeaderSignatureElement' and 'EnsureSignatureCoversExpectedTarget' to enforce proper signature coverage.
Affected products
- CoreWCF CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1
Timeline
- 2026-07-08: advisory: NVD publication date
- 2026-06-04: patched: Fix committed to repository
References
- https://github.com/CoreWCF/CoreWCF/commit/0589692d4b9a41d21b34ac48281e95f6df7f4ce5
- https://github.com/CoreWCF/CoreWCF/commit/30aef805270976c42477e3f2a05f4e563d86e247
- https://github.com/CoreWCF/CoreWCF/commit/4618f24165ad018ad3ed2636bf8c3bc87d2a3be2
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
- https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-gqv6-pwcg-87r8