WS-Security Signature Spoofing in CoreWCF

Executive Summary

This vulnerability exists in CoreWCF, a port of Windows Communication Foundation to .NET Core. Before versions 1.8.1 and 1.9.1, the WS-Security signature verification process performed a document-wide lookup for the ds:Signature element. This allowed an unauthenticated remote attacker to insert a SOAP header before the wsse:Security header, causing the system to verify an attacker-supplied signature instead of the legitimate security header signature.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can bypass proper signature verification by supplying their own signature. This can lead to unauthorized actions being accepted as valid, potentially allowing the attacker to impersonate legitimate users or services, manipulate data, or perform other malicious activities without authentication.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update CoreWCF to version 1.8.1 or 1.9.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0