CVE-2020-1045: ASP.NET Core Auth Bypass Vulnerability

CVE-2020-1045 Overview

A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names. The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded. This flaw enables attackers to potentially bypass security controls that rely on cookie integrity, such as authentication mechanisms or session management.

Critical Impact

Attackers can exploit improper cookie parsing to inject malicious cookies, potentially bypassing authentication and authorization controls in ASP.NET Core applications.

Affected Products

• Microsoft ASP.NET Core (versions prior to 3.1.8)
• Fedora 32 and 33
• Red Hat Enterprise Linux 8.0
• Red Hat Enterprise Linux AUS 8.2, 8.4, 8.6
• Red Hat Enterprise Linux EUS 8.2, 8.4, 8.6
• Red Hat Enterprise Linux TUS 8.2, 8.4, 8.6

Discovery Timeline

• 2020-09-11 - CVE-2020-1045 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2020-1045

Vulnerability Analysis

The vulnerability resides in the ASP.NET Core cookie parsing mechanism. When the framework processes incoming HTTP requests, it decodes the entire cookie string rather than treating cookie names as opaque identifiers. This behavior creates a parsing discrepancy that attackers can exploit to inject additional cookies into the request context.

The core issue stems from how percent-encoded characters are handled during cookie parsing. When an attacker sends a cookie with a percent-encoded name (e.g., %41uthToken instead of AuthToken), the parser decodes this name, potentially creating a collision with legitimate cookies or introducing entirely new cookie values that the application trusts implicitly.

This vulnerability is particularly concerning for applications that rely on cookie-based authentication, session management, or security tokens. An attacker could potentially set a forged authentication cookie, bypass security controls, or manipulate application state by injecting crafted cookies that appear legitimate after decoding.

Root Cause

The root cause is the improper handling of encoded cookie names in the ASP.NET Core cookie parser. The parser decodes the entire cookie string including names, which violates the principle that cookie names should be treated as literal strings. This allows attackers to use percent-encoding to smuggle cookie names that, once decoded, match existing legitimate cookie names or create new malicious entries.

Attack Vector

This vulnerability can be exploited remotely over the network without any authentication or user interaction. An attacker can craft malicious HTTP requests containing specially encoded cookie values that exploit the parsing flaw.

The attack flow involves:

1. The attacker identifies an ASP.NET Core application using cookie-based security mechanisms
2. The attacker crafts HTTP requests with percent-encoded cookie names designed to bypass security controls
3. When the ASP.NET Core application parses the request, it decodes the cookie names, potentially allowing the attacker's malicious cookies to override or supplement legitimate cookies
4. The application processes the injected cookies as if they were legitimate, potentially granting unauthorized access or privileges

For example, if an application checks for an AuthCookie, an attacker could send a request with %41uthCookie (where %41 is the percent-encoded value for 'A'), and after decoding, the malicious cookie would match the expected name.

Detection Methods for CVE-2020-1045

Indicators of Compromise

• HTTP requests containing unusual percent-encoded characters in cookie names
• Multiple cookies with similar names that differ only by encoding in server logs
• Authentication anomalies where users appear to be authenticated without proper credentials
• Unusual session behavior indicating cookie manipulation

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests with excessively percent-encoded cookie names
• Monitor application logs for cookie parsing errors or warnings that may indicate exploitation attempts
• Deploy endpoint detection solutions to identify unusual HTTP traffic patterns associated with cookie manipulation attacks
• Review authentication logs for signs of unauthorized access that may result from cookie injection

Monitoring Recommendations

• Enable detailed logging for ASP.NET Core cookie parsing operations in production environments
• Set up alerts for requests containing multiple cookies with similar decoded names
• Monitor for sudden spikes in authentication failures followed by successes from the same source
• Implement anomaly detection on cookie-related HTTP headers

How to Mitigate CVE-2020-1045

Immediate Actions Required

• Update ASP.NET Core to version 3.1.8 or later immediately
• Review and audit application cookie handling logic for any custom parsing implementations
• Apply vendor patches from Microsoft, Red Hat, or Fedora as appropriate for your platform
• Implement input validation on cookie values at the application level as an additional defense layer

Patch Information

Microsoft has addressed this vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names. The patch ensures that cookie names are treated as literal strings rather than being decoded during parsing.

For detailed patch information, refer to:

• Microsoft Security Advisory CVE-2020-1045
• GitHub Release Notes for ASP.NET Core 3.1.8
• Red Hat Security Advisory RHSA-2020:3699

Workarounds

• Implement strict cookie name validation at the application level before processing
• Use web application firewalls to filter requests with suspicious percent-encoded cookie names
• Consider implementing additional authentication factors that do not rely solely on cookie-based security
• Deploy network-level monitoring to detect and block exploitation attempts

# Update ASP.NET Core to patched version on Linux
dotnet --list-sdks
# Verify current version, then update
sudo apt-get update && sudo apt-get install dotnet-sdk-3.1

# For Red Hat Enterprise Linux systems
sudo dnf update dotnet