ASP.NET Security Feature Bypass Vulnerability

Vulnerability

Overview

CVE-2025-55315 is an HTTP request/response smuggling vulnerability in ASP.NET Core in ASP.NET Core that stems from an inconsistent interpretation of HTTP requests. The vulnerability affects multiple versions of ASP.NET Core, including 10.0 RC1, 9.1.0, 8.0, and 2.3 (via the Kestrel server package). The root cause is a discrepancy in how HTTP requests are parsed by different components or intermediaries, enabling a type of smuggling attack.

Exploitation

Prerequisites

An attacker must be authenticated and have network access to the target ASP.NET Core application to exploit this vulnerability. No additional mitigating factors have been identified by Microsoft, meaning the attack can be carried out without special conditions [1][2]. The HTTP request/response smuggling technique leverages the parsing inconsistency to present different request boundaries to different downstream systems.

Impact

Successfully exploiting this vulnerability allows an authorized attacker to bypass a security feature over the network. This could lead to achieving unauthorized actions, such as requesting protected resources, performing actions beyond the attacker's permission level, or injecting malicious content into other responses. The exact security feature bypassed is not specified, but it is a general security feature in ASP.NET Core.

Mitigation

Microsoft has released patches for all affected versions. The patched versions are ASP.NET Core 10.0.0-rc.2.25502.107, 9.0.10, 8.0.21, and Kestrel package version 2.3.6 [1][2]. No workarounds have been provided, administrators are strongly advised to update their applications to the latest patched versions immediately.