CoreWCF Unix Domain Socket Identity Bypass Vulnerability

Compliance Impact

The vulnerability in CoreWCF allows connections to bypass required security upgrades, potentially permitting unauthorized access by skipping framing-layer identity checks. This can lead to minimal impacts on confidentiality and integrity of data transmitted via the affected Unix Domain Socket transport.

Such unauthorized access risks could affect compliance with standards and regulations like GDPR and HIPAA, which mandate protection of sensitive data and proper authentication controls to prevent unauthorized access.

However, the vulnerability requires local access with low privileges and does not affect availability. Mitigations include upgrading to patched versions or restricting filesystem permissions on the Unix Domain Socket.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects CoreWCF versions 1.8.0 and 1.9.0 when using UnixDomainSocketBinding with Security.Mode set to TransportCredentialOnly and Security.Transport.ClientCredentialType set to PosixIdentity. Detection involves verifying the CoreWCF version and configuration to identify if the vulnerable setup is in use.

Since the vulnerability allows connections to skip the required application/unixposix stream upgrade, one detection approach is to check if the CoreWCF service is running on a vulnerable version and using Unix Domain Sockets with PosixIdentity client credentials.

Workarounds include restricting filesystem access to the Unix Domain Socket file using permissions (e.g., chmod 0660) and a dedicated group to limit unauthorized local access.

No specific commands are provided in the resources, but you can check the CoreWCF version by inspecting your application dependencies or binaries. For example, on a Unix-like system, you might run commands like:

• Check CoreWCF package version in your project files or package manager (e.g., dotnet list package)
• List Unix Domain Socket files and their permissions: ls -l /path/to/socket
• Check running processes and their loaded libraries to confirm CoreWCF version

Monitoring for unauthorized connections that bypass the stream upgrade would require application-level logging or custom instrumentation, as the vulnerability is related to internal stream upgrade logic.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in CoreWCF, a port of the Windows Communication Foundation service side to .NET Core. Before versions 1.8.1 and 1.9.1, a CoreWCF service hosted on Unix Domain Sockets using PosixIdentity client credentials could accept connections that bypass the required application/unixposix stream upgrade. This means that the framing-layer identity checks performed by the UnixPosixIdentitySecurityUpgradeProvider could be skipped, potentially allowing unauthorized connections.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows connections to bypass identity checks at the framing layer, which could lead to unauthorized access or impersonation of clients. This can compromise the integrity and confidentiality of communications between services and clients, potentially allowing attackers to send or receive messages without proper authentication.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade CoreWCF to version 1.8.1 or 1.9.1, where the issue has been fixed.

Useful 0 Not Useful 0