Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the Microsoft.AspNetCore.Authentication.Negotiate package when configured to use LDAP for role retrieval. The analysis of the patch commit af0f47f658f85daefb2b55cd11f7dc93b0c7798a revealed several flaws in the LdapAdapter.cs file.
The primary vulnerable function is RetrieveClaimsAsync. Before the patch, it was susceptible to two main issues:
userAccountName was used directly in an LDAP search filter without proper escaping. This allowed an attacker to inject malicious characters into the filter, potentially bypassing authentication or extracting sensitive information from the LDAP directory.The secondary vulnerable function is GetNestedGroups. This function was used to resolve nested group memberships. It looked up groups by their sAMAccountName or CN which could be ambiguous. An attacker could create a group with a common name that collides with a privileged group, and if the search returned the attacker's group first, they could be granted unintended permissions.
The patch addresses these issues by:
RetrieveClaimsAsync to ensure the user belongs to the configured domain.EscapeLdapFilterValue, to sanitize input used in LDAP filters, thus preventing LDAP injection attacks.GetNestedGroups to look up groups by their unique distinguishedName (DN) instead of the ambiguous CN, eliminating the possibility of group name collisions.Microsoft.AspNetCore.Authentication.Negotiate.Internal.LdapAdapter.RetrieveClaimsAsyncsrc/Security/Authentication/Negotiate/src/Internal/LdapAdapter.cs
Microsoft.AspNetCore.Authentication.Negotiate.Internal.LdapAdapter.GetNestedGroupssrc/Security/Authentication/Negotiate/src/Internal/LdapAdapter.cs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.AspNetCore.Authentication.Negotiate | nuget | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.AspNetCore.Authentication.Negotiate | nuget | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.AspNetCore.Authentication.Negotiate | nuget | >= 8.0.0, <= 8.0.28 | 8.0.29 |