CVE-2020-1161

Vulnerability

Overview CVE-2020-1161 is a denial-of-service (DoS) vulnerability in ASP.NET Core that arises when the framework improperly handles certain web requests. The root cause is a flaw in request processing logic that can be triggered by specially crafted input [1].

Exploitation

Details The vulnerability is remotely exploitable without authentication. An attacker can send a series of malicious requests to an affected ASP.NET Core application, causing excessive resource consumption or an unhandled exception that leads to a denial of service [2]. No special privileges or network position beyond standard internet access is required.

Impact

Successful exploitation allows an unauthenticated attacker to make the ASP.NET Core application unresponsive, disrupting service availability. The impact is limited to denial of service; no data disclosure or elevation of privilege is indicated [1][2].

Mitigation

Microsoft released an update that corrects how ASP.NET Core handles web requests, eliminating the vulnerability. The fix is included in .NET Core 3.1.4 and later. Users should update their runtime or SDK to the latest 3.1.x version. .NET Core 3.0, which is out of support, should be upgraded to 3.1 [2].