Critical Privilege Escalation Vulnerability in .NET 8.0 Packages
Summary
ALSA-2025:2670: Important: .NET 8.0 security, bug fix, and enhancement update. Affects aspnetcore-runtime-8.0 versions < 8.0.14-1.el8_10. Fixed in 8.0.14-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that provides a comprehensive programming model for building applications. It includes a Common Language Runtime (CLR) and a set of APIs that enable developers to create robust applications. The affected packages, including aspnetcore-runtime-8.0 and dotnet-sdk-8.0, are essential for running and developing .NET applications. The recent vulnerability poses a significant risk, allowing unauthorized users to escalate their privileges within applications using the SignInManager.RefreshSignInAsync method.
Vulnerability Detail
The vulnerability identified as CVE-2025-24070 is a privilege escalation issue within the .NET SignInManager.RefreshSignInAsync method. This flaw allows attackers to gain elevated permissions, potentially compromising sensitive data and application integrity. The vulnerability arises from improper handling of user authentication, which can be exploited by malicious actors to execute unauthorized actions within the application.
How To Fix
Minimum fixed version
8.0.14-1.el8_10
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the affected method until the packages can be updated. Implementing additional authentication checks or limiting user permissions may help mitigate the risk until a full patch is applied.
Conclusion
The privilege escalation vulnerability in .NET 8.0 packages poses a significant risk to applications utilizing the affected methods. It is imperative to update to the patched versions to safeguard against potential exploitation. Utilizing tools like Vulert can help monitor and alert for vulnerabilities in real-time.
See every vulnerability recorded for aspnetcore-runtime-8.0 →
FAQ
CVE-2025-24070 is a privilege escalation vulnerability in the .NET SignInManager.RefreshSignInAsync method that allows unauthorized users to gain elevated permissions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to execute unauthorized actions, potentially compromising sensitive data and application integrity.
You can update your .NET packages using the dnf package manager with the commands provided in the 'how_to_fix' section.
If immediate updates are not possible, consider implementing access restrictions and additional authentication checks as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-8.0.
