Microsoft is releasing this security advisory to provide information about a vulnerability in .NET and .NET Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An elevation of privilege vulnerability exists in ANCM which could allow elevation of privilege when .NET core, .NET 5 and .NET 6 applications are hosted within IIS.

Affected Software

Only applications hosted under IIS are vulnerable. If you use Kestrel as your web hosts you are not vulnerable.

• Any .NET 6.0 application hosted in IIS running on ANCM version 16.0.21299.0
• Any .NET 5.0 application hosted in IIS running on ANCM version 15.0.21297.12 or lower
• Any .NET Core 3.1 application hosted in IIS running on ANCM version 13.1.21296.21 or lower

You can check the ANCM version of the affected binary aspnetcorev2_inprocess.dll from "C:\Program Files\IIS\Asp.Net Core Module\V2"

Patches

To fix the issue, please install the latest version of hosting bundle.

• If you're using .NET 6.0, you should download and install the .NET 6.0.1 hosting bundle from https://dotnet.microsoft.com/download/dotnet-core/6.0 .

• If you're using .NET 5.0, you should download and install the .NET 5.0.13 hosting bundle from https://dotnet.microsoft.com/download/dotnet-core/5.0 .

• If you're using .NET Core 3.1, you should download and install .NET Core 3.1.22 from https://dotnet.microsoft.com/download/dotnet-core/3.1 .

Other Details

• Announcement for this issue can be found at dotnet/announcements#205
• An Issue for this can be found at #39028
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-43877