Microsoft released CVE-2020-1045 in September 2020.
A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.
The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.
The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.
The only way to mitigate this vulnerability is to update the .net core version of every application. They suggest 3.1 but the small print also suggests any thing higher than 2.1.21 will work.
The question on my mind though, is whether this vulnerability is actually exploitable.
It mentions that an attacker may be able to "bypass certain security restrictions" - but since an HTTP request can contain any cookie it wants, I can't see how the CVE changes anything. Its possible that for "security reasons" one or more Microsoft libraries refused to honour certain cookies based on their name by stripping them from the request header. Do any libraries use "secret cookies" which aren't supposed to be set by the user? If so, how are the values actually set?
- What kind of attack can I actually perform by creating additional cookies through this vulnerability, rather than using a Set-Cookie header? For example, is there possibly a privilege escalation attack?
- What security restrictions can be bypassed? Are they referring to security restrictions in related MS Libraries, or in third party libraries, or something else?
- Is there anything an attacker can do with this vulnerability that they cannot do with a normal Set-Cookie header? Even in theory?