Microsoft Security Advisory CVE-2021-41355 | .NET Core Information Disclosure Vulnerability

[rbhanda]

Microsoft Security Advisory CVE-2021-41355 | .NET Core Information Disclosure Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An Information Disclosure vulnerability exists in .NET where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on Linux and macOS.

Announcement

Announcement for this issue can be found at dotnet/announcements#202

Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

Affected software

Any .NET application that uses System.DirectoryServices.Protocols with a vulnerable version listed below on system based on Linux.

Package name	Vulnerable versions	Secure versions
System.DirectoryServices.Protocols	5.0.0	5.0.1

How do I know if I am affected?

If you are using a package version listed in affected software, you're exposed to the vulnerability.

How do I fix the issue?

To fix the issue, please update to the latest version of the affected software.

Other Information

Reporting Security Issues

If you have found a potential security issue in .NET, please email details to [email protected]. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime and https://github.com/dotnet/aspnet/. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2021-41355

Revisions

V1.0 (October 12, 2021): Advisory published.

Version 1.0

Last Updated 2021-10-12

[dotnet-issue-labeler]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[ghost]

Tagging subscribers to this area: @jay98014
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Microsoft Security Advisory CVE-2021-41355 | .NET Core Information Disclosure Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A Information Disclosure vulnerability exists in .NET where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on Linux.

Announcement

Announcement for this issue can be found at dotnet/announcements#202

Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

Affected software

Any .NET application that uses System.DirectoryServices.Protocols with a vulnerable version listed below on system based on Linux.

Package name	Vulnerable versions	Secure versions
System.DirectoryServices.Protocols	5.0.0 or lower	5.0.1

How do I know if I am affected?

If you are using a package version listed in affected software, you're exposed to the vulnerability.

How do I fix the issue?

To fix the issue, please update to the latest version of the affected software.

Other Information

Reporting Security Issues

If you have found a potential security issue in .NET, please email details to [email protected]. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime and https://github.com/dotnet/aspnet/. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2021-41355

Revisions

V1.0 (October 12, 2021): Advisory published.

Version 1.0

Last Updated 2021-10-12

Author:	rbhanda
Assignees:	-
Labels:	Security, area-System.DirectoryServices
Milestone:	-

[FelixSFD]

is it intended that updating from 5.0.0 to 5.0.1 results in this exception inside a Linux-container?

System.DirectoryServices.Protocols.LdapException: The feature is not supported. 
   at System.DirectoryServices.Protocols.LdapConnection.BindHelper(NetworkCredential newCredential, Boolean needSetCredential)
   at System.DirectoryServices.Protocols.LdapConnection.SendRequestHelper(DirectoryRequest request, Int32& messageID)
   at System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request, TimeSpan requestTimeout)
   at System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request)

We are currently still using LDAP and not LDAPS. We know, we should move to LDAPS soon anyway, but I don't think a breaking change like this should be rolled out as a patch-Version.

[poizan42]

@FelixSFD It looks like they added a switch to get the old behavior back: System.DirectoryServices.Protocols.UseBasicAuthFallback

I think you can enable it from runtimeConfig.json by adding

"configProperties": {
    "System.DirectoryServices.Protocols.UseBasicAuthFallback": true
}

This should re-enable the old insecure behavior - but it you were only using LDAP basic authentication over an unencrypted connection anyways then you are leaking the credentials in plain text no matter what you do.

(I haven't tested this, this is just from looking at the source)

[danmoseley]

@joperezr

[joperezr]

Hello @FelixSFD, yes the reason why you are seeing this is because during this servicing we also fix another issue where the AuthType was a) incorrectly being defaulted to Basic and b) ignored if you would set it to anything other than basic. The fix for that was to change the default to match both Windows and the underlying native libraries, which is AythType.Negotiate. We did add that app context switch in case you couldn’t recompile the code and were broken due to this change, but if you do have the capacity to change the code, the fix is to set the connection’s AuthType to Basic explicitly. Apologies for the inconvenience and do let us know if that doesn’t work for you.

[joperezr]

but it you were only using LDAP basic authentication over an unencrypted connection anyways then you are leaking the credentials in plain text no matter what you do

@poizan42 this is not entirely true. Even when using basic credentials, you can still opt to call connection.SessionOptions.StartTransportLayerSecurity() before calling connection.Bind(). The credentials aren’t exchanged until calling bind method, so if you start TLS encryption before that happens, then all the communication from that point on will be encrypted, including the exchange of basic credentials.

[FelixSFD]

@poizan42 @joperezr Thank you! :-) Setting System.DirectoryServices.Protocols.UseBasicAuthFallback to true did work.

I also tried to use AuthType.Basic, but for some reason, this resulted in this exception:

System.DirectoryServices.Protocols.LdapException: The supplied credential is invalid.
   at System.DirectoryServices.Protocols.LdapConnection.BindHelper(NetworkCredential newCredential, Boolean needSetCredential)
   at System.DirectoryServices.Protocols.LdapConnection.SendRequestHelper(DirectoryRequest request, Int32& messageID)
   at System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request, TimeSpan requestTimeout)
   at System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request)

However, our domain controller is quite old and I'm not even sure what authentication types are enabled. So this might be an issue with our local configuration. We'll use the workaround for now and plan to switch to LDAPS when we upgrade to .NET 6.0 later this year.

---

Just out of couriosity: Is there any way to view detailed changelogs of the .NET libraries? I couldn't find any list of things that were changed in 5.0.1 except this Security Advisory and this list without much detail.

[daxin09pp]

Does this issue affect .NET Core 3.1? The System.DirectoryServices.Protocols's version is 4.7.0.
Thanks,

[joperezr]

It does not. This only affects Linux implementation, which only shipped starting from the package 5.0, so 4.7.0 doesn't even support Linux yet. The only affected package here is 5.0.0

[daxin09pp]

Hi @joperezr,

Thank you for your reply.
But I see NuGet has this issue with version 4.7.0 as well.
https://www.nuget.org/packages/System.DirectoryServices.Protocols/4.7.0
Is NuGet wrong?

Thanks,

[joperezr]

Good point, that seems to be a bug in our docs, since the CVE also mentions that all 5.0.0 or lower versions are affected, which is not true. cc @rbhanda is that something you can help fix here?

[rbhanda]

I have updated the security advisory patches table affected version to "5.0.0" from "5.0.0 or lower" but the package affected version was always 5.0.0. I am not sure how https://www.nuget.org/packages/System.DirectoryServices.Protocols/4.7.0 got updated.

[anjbur]

Are there any plans to patch this in the .NET 5 line of the package Microsoft.Windows.Compatibility? We're getting this security alert for using Microsoft.Windows.Compatibility version 5.0.2.

[danmoseley]

@anjbur I don't have info about this change, but note that 5.0 is out of support very soon: on May 8th. Can you update to 6.0?

[joperezr]

@anjbur you only get the warning because Microsoft.Windows.Compatibility package depends on System.DirectoryServices.Protocols version 5.0.0. You can manually add an explicit reference in your project to System.DirectoryServices.Protocols version 5.0.1 which would get rid of the security alert, or alternatively, as my colleague @danmoseley suggests update and target 6.0 where the issue doesn't exist. There are no plans to service Microsoft.Windows.Compatibility just to increment the dependency version of System.DirectoryServices.Protocols

[anjbur]

@danmoseley @joperezr We are in the process of updating to 6.0, but were looking to resolve this security alert in the meantime. We can certainly add the explicit reference to System.DirectoryServices.Protocols, thank you for the guidance!