.NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability

Vulnerability

Analysis

The vulnerability lies in the SMTP client implementation of .NET 8.0 (up to version 8.0.20) and .NET 9.0 (up to version 9.0.9) [1][2]. Inadequate encryption strength allows a man-in-the-middle (MITM) attacker to interfere with the TLS negotiation between a .NET SMTP client and an SMTP server. The attacker can prevent the use of TLS, forcing the client to fall back to an unencrypted connection [1][2][3]. This is a downgrade attack that bypasses the intended transport security.

Exploitation

Prerequisites

An attacker must be positioned on the network path between the affected .NET application and the SMTP server, i.e., a MITM position. No special authentication or privileges beyond network access are required. The attack does not need any user interaction beyond the normal operation of the SMTP client [1][3]. There are no mitigating factors identified by Microsoft [2][3].

Impact

A successful attack allows the attacker to eavesdrop on all email communications transmitted by the affected application. Sensitive information such as credentials, message content, and recipient details can be disclosed over the network in plaintext [1]. The confidentiality of data processed by the SMTP client is fully compromised.

Mitigation

Microsoft has released patched versions: .NET 8.0.21 and .NET 9.0.10 [1][2][3]. Developers must update their applications to use these patched runtime packages. For a full list of affected package names (e.g., Microsoft.NetCore.App.Runtime.linux-x64), refer to the advisory tables. No workaround is available [1][2].