.NET Elevation of Privilege Vulnerability
Date: 2023-06
Affected: nuget/Microsoft.NetCore.App.Runtime.win-x86, nuget/Microsoft.NetCore.App.Runtime.win-x64, nuget/Microsoft.NetCore.App.Runtime.win-arm64
Attack vector: deserialization
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-24936
CVSS: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

# Microsoft Security Advisory CVE-2023-24936: .NET Elevation of Privilege Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET when deserializing a DataSet or DataTable from XML which may result in elevation of privileges. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/259 ### <a name="mitigation-factors"></a>Mitigation factors The default configuration of DataSet and DataTable is not susceptible to this vulnerability. This vulnerability only exists if the app developer or machine admin extends the DataSet and DataTable default allow-list [as specified here](https://learn.microsoft.com/en-us/dotnet/framework/data/adonet/dataset-datatable-dataview/security-guidance) to contain specific types which trigger the vulnerability. ## <a name="affected-software"></a>Affected software * Any .NET 7.0 application running on .NET 7.0.5 or earlier. * Any .NET 6.0 application running on .NET 6.0.16 or earlier. If your application uses the following package versions, ensure you update to the latest version of .NET. ### <a name=".NET 7"></a>.NET 7 Package name | Affected version | Patched version ------------ | ---------------- | ------------


Mitigations:

Architectural layers (MAESTRO):