Описание
ASP.NET Core Cross Site Request Forgery Vulnerabilty
A Cross Site Request Forgery (CSRF) vulnerability exists when a ASP.NET Core web application is created using vulnerable project templates.
An attacker who successfully exploited this vulnerability could change the recovery codes associated with the victim's user account without his/her consent. As a result, a victim of this attack may be permanently locked out of his/her account after loosing access to his/her 2FA device, as the initial recovery codes would be no longer valid.
The update corrects the ASP.NET Core project templates.
FAQ
What does the update do? The update corrects the project templates for ####. The template updates only affect new applications. For this reason, Microsoft strongly recommends that developers who have built web applications using these templates take immediate action to evaluate their web applications for exposure to the vulnerability, and then use the workarounds in the Suggested Actions section to make code changes to update their applications to protect them from the vulnerability.
If you are running Visual Studio 2013, you need to use the workaround steps listed in the Suggested Actions section to update your applications manually every time you use the affected templates.
How do I apply the update?
- Start Visual Studio.
- Under the Tools menu, choose Extensions and Updates.
- Expand the Updates tree.
- Under Product Updates locate the following two entries: • Microsoft ASP.NET and Web Tools • Microsoft ASP.NET Web Frameworks and Tools
- Select each update and click Update.
Suggested Actions The following workaround information details the changes that you must make to existing applications created from the ASP.NET project templates. Visual Studio 2015 MVC 5 and Visual Studio 2013 MVC 5 For C#
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
Older Software Release
EPSS
Связанные уязвимости
ASP.NET Core 1.0. 1.1, and 2.0 allow a cross site request forgery vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Cross Site Request Forgery Vulnerability".
ASP.NET Core 1.0. 1.1, and 2.0 allow a cross site request forgery vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Cross Site Request Forgery Vulnerability".
EPSS