Microsoft .NET core is vulnerable to a security bypass due to improper input validation, that could lead to arbitrary file write.
PUBLISH DATE: 15-11-2018
A vulnerability has been reported in Microsoft .NET Core, which can be exploited by malicious people to manipulate certain data. This tampering error exists when .NET Core improperly handles specially crafted files (input validation error).
The An error related to the “ExtractRelativeToDirectory()” function can be exploited to write arbitrary files via a specially crafted file. Users of Microsoft .NET Core may suffer from a security-bypass attack in case of successful exploitation of this vulnerability.
Attackers bypassing certain security restrictions may perform unauthorized actions, write arbitrary files and directories to certain locations on a vulnerable system or launch other attacks. The manipulation with an unknown input leads to a privilege escalation vulnerability.
However, to exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system.
The security update fixes the vulnerability by ensuring that .NET Core properly handles files.
Microsoft .NET Core 2.1
The issue is fixed in the source code repository.
If you think you’re the victim of a cyber-attack, immediately send an email to firstname.lastname@example.org.