CVE-2020-1045
📋 TL;DR
This vulnerability allows attackers to bypass ASP.NET Core's cookie security by setting a second cookie with a percent-encoded name. The parser incorrectly decodes entire cookie strings, enabling cookie spoofing. Affects applications using Microsoft ASP.NET Core with vulnerable versions.
💻 Affected Systems
- Microsoft ASP.NET Core
📦 What is this software?
Asp.net Core by Microsoft
Asp.net Core by Microsoft
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Authentication bypass leading to unauthorized access to user accounts or administrative functions.
Likely Case
Session hijacking or privilege escalation through cookie manipulation.
If Mitigated
Minimal impact if proper input validation and cookie handling are implemented.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests with encoded cookie names.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ASP.NET Core 3.1.8 or later
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1045
Restart Required: Yes
Instructions:
1. Update ASP.NET Core runtime to version 3.1.8 or later. 2. Update all ASP.NET Core applications to target the patched runtime. 3. Restart application services.
🔧 Temporary Workarounds
Custom Cookie Parser
allImplement custom cookie parsing logic that validates and sanitizes cookie names before processing.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests with percent-encoded cookie names.
- Monitor and alert on unusual cookie patterns in application logs.
🔍 How to Verify
Check if Vulnerable:
Check ASP.NET Core runtime version using 'dotnet --info' command.Check Version:
dotnet --info | findstr "Version"Verify Fix Applied:
Verify runtime version is 3.1.8 or later and test cookie handling with encoded names.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing percent-encoded cookie names
- Multiple cookies with similar names
Network Indicators:
- Unusual cookie patterns in HTTP headers
- Requests attempting cookie manipulation
SIEM Query:
source="web_logs" AND (cookie_name="%25" OR cookie_name CONTAINS "%")🔗 References
- https://access.redhat.com/errata/RHSA-2020:3699
- https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.8/3.1.8.md#changes-in-318
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LN2FUVBSVPGK7AU3NMLO3YR6CGONQPB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ASICXQXS4M7MTAF6SGQMCLCA63DLCUT3/
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1045
- https://security.snyk.io/vuln/SNYK-RHEL8-DOTNET-1439600
- https://access.redhat.com/errata/RHSA-2020:3699
- https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.8/3.1.8.md#changes-in-318
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LN2FUVBSVPGK7AU3NMLO3YR6CGONQPB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ASICXQXS4M7MTAF6SGQMCLCA63DLCUT3/
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1045
- https://security.snyk.io/vuln/SNYK-RHEL8-DOTNET-1439600
