Microsoft Security Advisory CVE-2023-36049: .NET Elevation of Privilege Vulnerability
Date: 2023-11
Affected: nuget/System.Net.Requests, nuget/System.Net.Requests, nuget/System.Net.Requests
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-36049
CWE: CWE-20
CVSS: 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L)

# Microsoft Security Advisory CVE-2023-36049: .NET Elevation of Privilege Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 7.0 and .NET 8.0 RC2. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability. An elevation of privilege vulnerability exists in .NET where untrusted URIs provided to System.Net.WebRequest.Create can be used to inject arbitrary commands to backend FTP servers. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/287 ### <a name="mitigation-factors"></a>Mitigation factors Microsoft has not identified any mitigating factors for this vulnerability. ## <a name="affected-software"></a>Affected software * Any .NET 6.0 application running on .NET 6.0.24 or earlier. * Any .NET 7.0 application running on .NET 7.0.13 or earlier. * Any .NET 8.0 application running on .NET 8.0 RC2. ## Advisory FAQ ### <a name="how-affected"></a>How do I know if I am affected? If you have a runtime or SDK with a version listed, or an affected package listed in [affected software](#affected-software), you're exposed to the vulnerability. ### <a name="how-fix"></a>How do I fix the issue? * To fix the issue please install the latest version of .NET 8.0 or .NET 7.0 or .NET 6.0. If you have installed one or more .NET SDKs through V


Mitigations:

Architectural layers (MAESTRO):