ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

Vulnerability

Overview

CVE-2023-35391 is an information disclosure vulnerability in ASP.NET Core SignalR when configured with a Redis backplane. The root cause lies in the Redis backplane implementation failing to properly enforce connection authentication, potentially allowing an attacker to receive messages intended for other users [1][2].

Exploitation

The vulnerability affects ASP.NET Core 2.1, .NET 6.0, and .NET 7.0 applications using SignalR with a Redis backplane. An attacker who can connect to the SignalR hub may be able to subscribe to groups or receive messages without proper authorization, bypassing the application's authentication checks. No additional mitigating factors were identified by Microsoft [1][2].

Impact

A successful exploit could lead to information disclosure, where an attacker gains access to sensitive data transmitted over SignalR connections. This includes any messages or data exchanged within SignalR groups that the attacker is not authorized to receive [1][2].

Mitigation

Microsoft has released updates to address this vulnerability. Users should upgrade the relevant NuGet packages to the patched versions: for .NET 7.0, update Microsoft.AspNetCore.SignalR.StackExchangeRedis to 7.0.10 or later; for .NET 6.0, update to 6.0.21 or later; and for ASP.NET Core 2.1, update Microsoft.AspNetCore.SignalR.Redis to version 1.0.40 or later. No workarounds are available [1][2].