NetNamedPipe Local Interception in CoreWCF

Compliance Impact

This vulnerability allows local interception of NetNamedPipe traffic due to a race condition in the CoreWCF NetNamedPipe transport. Such interception could lead to unauthorized access to sensitive data transmitted over the named pipe.

Unauthorized interception and potential exposure of sensitive data can impact compliance with data protection standards and regulations such as GDPR and HIPAA, which require the protection of personal and health information against unauthorized access.

Therefore, systems using vulnerable versions of CoreWCF prior to 1.8.1 and 1.9.1 may face increased risk of non-compliance with these regulations until the issue is remediated.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a race condition in the CoreWCF NetNamedPipe transport where an attacker can intercept local named pipe traffic by creating a pipe with the same GUID before the service does. Detection involves monitoring for unauthorized or unexpected named pipe instances that may indicate interception attempts.

Since the issue is local and related to named pipes, detection can be done by checking for named pipes that are created before the CoreWCF service starts or by monitoring for multiple processes attempting to create or attach to the same named pipe.

Suggested commands to detect suspicious named pipe activity on a Windows system include:

• Using PowerShell to list named pipes: Get-ChildItem \\.\pipe\
• Using Sysinternals' PipeList tool to enumerate named pipes and identify unexpected pipe instances.
• Using Process Monitor (ProcMon) to trace CreateNamedPipe calls and detect if multiple processes are attempting to create or attach to the same pipe.

Additionally, reviewing logs or implementing monitoring to detect AddressAccessDeniedException errors during CoreWCF startup may indicate attempts to create a pipe with a name already in use.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in CoreWCF, a port of the Windows Communication Foundation to .NET Core. Specifically, in versions prior to 1.8.1 and 1.9.1, the NetNamedPipe transport allows an attacker to attach to a pre-existing named pipe instance. This happens because an attacker can race the NamedPipeListener startup process between the publication of a shared memory GUID and the creation of the service named pipe. As a result, the attacker can locally intercept NetNamedPipe traffic.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to local interception of NetNamedPipe traffic, which means an attacker with local access could eavesdrop on or potentially manipulate communication intended for the CoreWCF service. This can compromise the confidentiality and integrity of the data being transmitted over the named pipe.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade CoreWCF to version 1.8.1 or 1.9.1, where the issue has been fixed.

Useful 0 Not Useful 0