Skip to content
OpenAdvisories
Medium Public exploit CVE-2017-0248 EUVD-2018-0579GHSA-ch6p-4jcm-h8vh

Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc and Microsoft.AspNetCore.Mvc.Core

Published May 12, 2017 · Updated Aug 5, 2024 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft .NET Framework Package: Microsoft.AspNetCore.Mvc Package: Microsoft.AspNetCore.Mvc.Abstractions Package: Microsoft.AspNetCore.Mvc.ApiExplorer Package: Microsoft.AspNetCore.Mvc.Core Package: Microsoft.AspNetCore.Mvc.Cors Package: Microsoft.AspNetCore.Mvc.DataAnnotations Package: Microsoft.AspNetCore.Mvc.Formatters.Json Package: Microsoft.AspNetCore.Mvc.Formatters.Xml Package: Microsoft.AspNetCore.Mvc.Localization Package: Microsoft.AspNetCore.Mvc.Razor Package: Microsoft.AspNetCore.Mvc.Razor.Host Package: Microsoft.AspNetCore.Mvc.TagHelpers Package: Microsoft.AspNetCore.Mvc.ViewFeatures Package: Microsoft.AspNetCore.Mvc.WebApiCompatShim Package: System.Net.Http Package: System.Net.Http.WinHttpHandler Package: System.Net.Security Package: System.Net.WebSockets.Client Package: System.Text.Encodings.Web Ecosystem: NuGet

Description

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."

Affected products

VendorProductAffectedFixed
Microsoft Microsoft .NET Framework Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • rubenmamo/CVE-2017-0248-Test ★ 0 · Jan 29, 2019

    Sample project to test using Microsoft.CodeDom.Providers.DotNetCompilerPlatform 2.0.1 causing CVE-2017-0248

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Microsoft.AspNetCore.Mvc >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Abstractions >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Abstractions >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.ApiExplorer >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.ApiExplorer >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Core >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Core >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Cors >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Cors >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.DataAnnotations >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.DataAnnotations >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Formatters.Json >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Formatters.Json >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Formatters.Xml >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Formatters.Xml >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Localization >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Localization >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Razor >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Razor >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Razor.Host >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.Razor.Host >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.TagHelpers >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.TagHelpers >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.ViewFeatures >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.ViewFeatures >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.WebApiCompatShim >= 1.0.0, < 1.0.4 1.0.4 GHSA-ch6p-4jcm-h8vh
NuGet Microsoft.AspNetCore.Mvc.WebApiCompatShim >= 1.1.0, < 1.1.3 1.1.3 GHSA-ch6p-4jcm-h8vh
NuGet System.Net.Http >= 4.1.1, < 4.1.2 4.1.2 GHSA-ch6p-4jcm-h8vh
NuGet System.Net.Http >= 4.3.1, < 4.3.2 4.3.2 GHSA-ch6p-4jcm-h8vh
NuGet System.Net.Http.WinHttpHandler >= 4.0.0, < 4.0.1 4.0.1 GHSA-ch6p-4jcm-h8vh
NuGet System.Net.Http.WinHttpHandler >= 4.3.0, < 4.3.1 4.3.1 GHSA-ch6p-4jcm-h8vh
NuGet System.Net.Security >= 4.0.0, < 4.0.1 4.0.1 GHSA-ch6p-4jcm-h8vh
NuGet System.Net.Security >= 4.3.0, < 4.3.1 4.3.1 GHSA-ch6p-4jcm-h8vh
NuGet System.Net.WebSockets.Client >= 4.0.0, < 4.0.1 4.0.1 GHSA-ch6p-4jcm-h8vh
NuGet System.Net.WebSockets.Client >= 4.3.0, < 4.3.1 4.3.1 GHSA-ch6p-4jcm-h8vh
NuGet System.Text.Encodings.Web >= 4.0.0, < 4.0.1 4.0.1 GHSA-ch6p-4jcm-h8vh
NuGet System.Text.Encodings.Web >= 4.3.0, < 4.3.1 4.3.1 GHSA-ch6p-4jcm-h8vh

References