Horizon Alert
Summary of the vulnerability and why it matters
A security vulnerability has been identified in CoreWCF, a component used for building Windows Communication Foundation services on .NET Core. This issue could allow an unauthenticated attacker to impersonate users by improperly validating security tokens. The main concern is confirming relevance and exposure to your deployed services.
- Attackers could impersonate users.
- Affects services using specific security token validation.
- Confirm relevance and exposure to your deployed services.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can impersonate users by exploiting a flaw in how CoreWCF handles SAML tokens. This occurs when using federated bindings with specific IdentityConfiguration settings, as the system may not correctly validate the issuer's signature. Successful exploitation allows the attacker to assume the identity of any user that a trusted Security Token Service (STS) can issue tokens for, leading to significant compromise.
- No authentication required.
- Invalid SAML token issuer validation.
- Impersonate any federated user.
Live Threat
Current exploitation, exposure, and threat context
CoreWCF services using SAML token validation with federated bindings could allow an unauthenticated remote attacker to impersonate users. This occurs when the issuer signing key is not correctly resolved or signed tokens are not required.
- Service identity and user impersonation.
- Unauthenticated remote access to service.
- Compromise of authorized service actions.
Operational Fix
Recommended remediation, mitigation, and detection steps
Application owners and platform teams are likely responsible for managing CoreWCF, as it's used to build WCF services on .NET Core, often deployed as internet-facing APIs or federated identity endpoints. The first practical step is to identify where CoreWCF is deployed, assess its exposure and criticality, and locate the accountable owner to plan remediation based on risk.
- Identify CoreWCF deployments and criticality.
- Verify federated binding configurations.
- Plan risk-based remediation and vendor coordination.
