Microsoft .NET and ASP.NET: Privilege escalation vulnerability
A local privilege escalation vulnerability in Microsoft .NET and ASP.NET allows a local attacker to obtain the highest level of system privileges.
Triage facts
Revision 1- Applicability
- .NET, ASP.NET
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 26, 19:11 UTC
- Source quality
- A1Roughly even chance
Microsoft has disclosed a security vulnerability affecting .NET and ASP.NET runtimes. The vulnerability enables a local attacker to successfully perform privilege escalation, resulting in the acquisition of elevated system-level permissions. Details regarding the exploitation vector remain limited in the public advisory.
Impact
Successful exploitation allows a local attacker to escalate privileges to the highest level of system access on the affected host, potentially granting full control over the operating system or application environment.
Recommendation
- Audit all systems for installed versions of Microsoft .NET and ASP.NET runtimes.
- Apply the latest security updates provided by Microsoft to mitigate the escalation path.
- Monitor local system logs for unauthorized attempts to escalate privileges or unexpected process executions with SYSTEM or root identity.
Immediate actions
Identify and patch all .NET and ASP.NET runtimes on server and workstation fleets.
Threat Hunt
Monitor for suspicious use of local privilege escalation techniques following potential initial access.
Data: Endpoint telemetry showing unauthorized process elevation
Mitigations
Apply latest Microsoft security updates for .NET and ASP.NET runtimes.
Local privilege escalation vulnerability