CVE-2018-0787

Vulnerability

ASP.NET Core versions 1.0, 1.1, and 2.0 contain an elevation of privilege vulnerability due to how web applications created from templates validate web requests. The issue occurs when an application is hosted directly on Kestrel, which does not perform host header validation, or when hosted behind a proxy that does not validate or restrict host headers to known good values. For ASP.NET Core 2.0, packages Microsoft.AspNetCore.HttpOverrides versions 2.0.0 and 2.0.1 and Microsoft.AspNetCore.Server.Kestrel.Core versions 2.0.0 and 2.0.1 are also affected [1][3].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted HTTP request with a malicious Host header to an affected ASP.NET Core application. No authentication or user interaction is required; the attacker only needs network access to the service. If the application relies on the Host header for generating links or enforcing security policies, the attacker can manipulate the header to redirect traffic, inject content, or bypass security checks, leading to elevation of privilege [1].

Impact

Successful exploitation allows an attacker to elevate their privileges within the context of the web application. This could lead to actions such as bypassing authorization checks, accessing resources intended for higher-privileged users, or performing operations that should be restricted, potentially compromising the confidentiality, integrity, or availability of the application [1][2].

Mitigation

For ASP.NET Core 2.0, update packages Microsoft.AspNetCore.HttpOverrides to version 2.0.2 or later and Microsoft.AspNetCore.Server.Kestrel.Core to version 2.0.2 or later [1][3]. No patches are available for ASP.NET Core 1.0.x or 1.1.x; these versions are out of support (EOL) and should be upgraded to a supported version [1]. As a workaround, ensure the application is hosted behind a proxy (e.g., IIS, NGINX, Apache) that validates the Host header and is configured to listen on fully qualified domain names or controlled wildcard subdomains. Apps hosted in Azure Web Apps are not susceptible [1].