SB2017011101 - Security restrictions bypass in Microsoft Identity Model Extensions
Published: January 11, 2017
Security Bulletin ID
SB2017011101
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Privilege escalation (CVE-ID: N/A)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to an error when handling tokens signed with symmetric keys in Microsoft.IdentityModel.Tokens 5.1.0. If a token signed with a symmetric key is used to verify the identity of a user, and the app makes decisions based on the verified identity of that user, then the app could make incorrect decisions that result in elevation of privilege.
Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication process and gain unauthorized access to vulnerable system.
Microsoft .NET Core or .NET Framework project is affected by the vulnerability if it uses the package Microsoft.IdentityModel.Tokens version 5.1.0.
The vulnerability exists due to an error when handling tokens signed with symmetric keys in Microsoft.IdentityModel.Tokens 5.1.0. If a token signed with a symmetric key is used to verify the identity of a user, and the app makes decisions based on the verified identity of that user, then the app could make incorrect decisions that result in elevation of privilege.
Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication process and gain unauthorized access to vulnerable system.
Microsoft .NET Core or .NET Framework project is affected by the vulnerability if it uses the package Microsoft.IdentityModel.Tokens version 5.1.0.
Remediation
Install update from vendor's website.