Product:
ASP.NET Core
Summary
Inconsistent interpretation of http requests in ASP.NET Core allows an authorized attacker to bypass a security feature over a network. This vulnerability can lead to significant security risks, including unauthorized access to sensitive data. The issue arises from how the framework processes http requests, which can be exploited by attackers.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.9 | CVE-2025-55315 |
Exploitation
To exploit this vulnerability, an attacker can craft specific http requests that manipulate the way ASP.NET Core interprets them. By sending these specially crafted requests, the attacker can bypass security features and gain unauthorized access to resources. This requires low privileges and can be executed over the network without user interaction.
Affected Products
- ASP.NET Core: A framework for building web applications that is vulnerable to http request smuggling, allowing attackers to bypass security features.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of ASP.NET Core where the issue has been addressed. Additionally, implementing proper input validation and monitoring network traffic for unusual patterns can help reduce the risk of exploitation.