CVE-2019-1075: Open redirect in ASP.NET Core
Summary
CVE-2019-1075: Open redirect in ASP.NET Core. Affects Microsoft.AspNetCore.App across 2 version ranges.
>= 2.1.0, < 2.1.12
>= 2.2.0, < 2.2.6
Fixed in 2.1.12 or 2.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Microsoft.AspNetCore.App package is a NuGet package that provides a framework for building web applications with ASP.NET Core. It includes libraries, templates, and tools for creating and running ASP.NET Core applications. The package is widely used in the development of web applications and provides various features and functionalities for building robust and secure web applications.
Vulnerability Detail
The ASP.NET Core Spoofing Vulnerability (CVE-2019-1075) is a spoofing vulnerability that exists in ASP.NET Core. This vulnerability could allow an attacker to perform an open redirect attack. An open redirect vulnerability occurs when a web application accepts a user-supplied input and uses it to redirect the user to a different URL without proper validation. This can be exploited by an attacker to trick users into visiting malicious websites or disclosing sensitive information. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 2.1.122.1.12 -
>= 2.2.0, < 2.2.62.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the affected packages to the latest versions.
Conclusion
The ASP.NET Core Spoofing Vulnerability (CVE-2019-1075) is a moderate severity vulnerability that allows for open redirect attacks. To mitigate this vulnerability, it is crucial to update the affected packages to the fixed versions. Additionally, it is recommended to regularly monitor and scan your application for open-source vulnerabilities using tools like Vulert to ensure the security of your ASP.NET Core application.
See every vulnerability recorded for Microsoft.AspNetCore.App →
FAQ
ASP.NET Core is a cross-platform, high-performance, open-source framework for building modern, cloud-based, internet-connected applications.
An open redirect vulnerability occurs when a web application accepts a user-supplied input and uses it to redirect the user to a different URL without proper validation. This can be exploited by an attacker to trick users into visiting malicious websites or disclosing sensitive information.
The impact of this vulnerability is that it allows an attacker to perform an open redirect attack, potentially leading to the disclosure of sensitive information or the execution of malicious actions on the user's behalf.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your packages.config file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in fixing the vulnerability in your ASP.NET Core application.
References
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.AspNetCore.App.
