Input validation error in ASP.NET Core MVC and Microsoft .NET Core - CVE-2021-26701

Vulnerability identifier: #VU50496

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-26701

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in .NET Core. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

ASP.NET Core MVC
Microsoft .NET Core
Arch Linux
Red Hat Enterprise Linux for x86_64
Anolis OS
Fedora
rh-dotnet21 (Red Hat package)
rh-dotnet21-dotnet (Red Hat package)
dotnet (Red Hat package)
rh-dotnet31-dotnet (Red Hat package)
dotnet3.1 (Red Hat package)
rh-dotnet50-dotnet (Red Hat package)
dotnet5.0 (Red Hat package)
dotnet-runtime-2.1
dotnet-host-fxr-2.1
dotnet-sdk-2.1.5xx
dotnet-sdk-2.1
dotnet-targeting-pack-3.1
dotnet-runtime-3.1
dotnet-hostfxr-3.1
dotnet-apphost-pack-3.1
aspnetcore-targeting-pack-3.1
aspnetcore-runtime-3.1
dotnet3.1
dotnet-sdk-3.1
dotnet-sdk-3.1-source-built-artifacts
dotnet-templates-3.1
dotnet5.0
IBM Process Mining
Cortex XSOAR

Install updates from vendor's website.

rh-dotnet21 (Red Hat package) - update to 2.1-25.el7_9
rh-dotnet21-dotnet (Red Hat package) - update to 2.1.522-1.el7_9
dotnet (Red Hat package) - update to 2.1.522-1.el8_3
rh-dotnet31-dotnet (Red Hat package) - update to 3.1.113-1.el7_9
dotnet3.1 (Red Hat package) - update to 3.1.113-1.el8_3
rh-dotnet50-dotnet (Red Hat package) - update to 5.0.104-1.el7_9
dotnet5.0 (Red Hat package) - update to 5.0.104-1.el8_3
IBM Process Mining - update to 1.13.2
dotnet-runtime-2.1 - update to 2.1.30-1
dotnet-host-fxr-2.1 - update to 2.1.30-1
dotnet-sdk-2.1.5xx - update to 2.1.526-1
dotnet-sdk-2.1 - update to 2.1.526-1
dotnet-targeting-pack-3.1 - update to 3.1.26-1.0.1
dotnet-runtime-3.1 - update to 3.1.26-1.0.1
dotnet-hostfxr-3.1 - update to 3.1.26-1.0.1
dotnet-apphost-pack-3.1 - update to 3.1.26-1.0.1
aspnetcore-targeting-pack-3.1 - update to 3.1.26-1.0.1
aspnetcore-runtime-3.1 - update to 3.1.26-1.0.1
dotnet3.1 - addressed in versions 3.1.113-1.fc32, 3.1.113-1.fc33, 3.1.113-1.fc34
dotnet-sdk-3.1 - update to 3.1.420-1.0.1
dotnet-sdk-3.1-source-built-artifacts - update to 3.1.420-1.0.1
dotnet-templates-3.1 - update to 3.1.420-1.0.1
dotnet5.0 - addressed in versions 5.0.104-1.fc32, 5.0.104-1.fc33, 5.0.104-1.fc34
Cortex XSOAR - update to 7.1.3.20270

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26701

• Multiple vulnerabilities in Microsoft .NET Core and Visual Studio
• Red Hat Enterprise Linux 8 update for .NET Core 2.1
• Red Hat Enterprise Linux 8 update for .NET Core 3.1
• .NET Core on Red Hat Enterprise Linux update for rh-dotnet21-dotnet
• .NET Core on Red Hat Enterprise Linux update for rh-dotnet31-dotnet
• Red Hat Enterprise Linux 8 update for .NET 5.0
• .NET on Red Hat Enterprise Linux update for rh-dotnet50-dotnet
• Arch Linux update for dotnet-runtime
• Arch Linux update for dotnet-sdk
• Arch Linux update for dotnet-runtime-3.1
• Arch Linux update for dotnet-sdk-3.1
• Remote code execution in Palo Alto Networks Cortex XSOAR
• IBM Process Mining update for Microsoft .NET Core and Visual Studio
• Fedora 34 update for dotnet5.0
• Fedora 33 update for dotnet5.0
• Fedora 32 update for dotnet5.0
• Fedora 34 update for dotnet3.1
• Fedora 33 update for dotnet3.1
• Fedora 32 update for dotnet3.1
• Anolis OS update for dotnet
• Anolis OS update for dotnet3.1