CVE-2023-36558

What it actually does

The flaw permits a local low-privileged user to bypass authorization checks in ASP.NET Core, exposing confidential data that should remain restricted.

Why it matters to the business

Organizations face risk of unauthorized disclosure of sensitive information from systems running affected dotnet/core versions, potentially triggering compliance violations and reputational harm; the issue remains unexploited in the wild but has been public for nearly three years.

How an attack unfolds

An attacker with local access on an affected system crafts inputs or uses existing processes to trigger the authorization bypass, reading files or memory contents that authorization logic should have blocked.

How to fix it

Update dotnet/core (GIT) to commit d78b3180414d35d6c7d136db753474e2ae2b33df or newer; rebuild and redeploy all dependent applications after the update.

How to confirm the fix worked

Inspect the runtime or application binary for the presence of the fixed commit hash; confirm that authorization checks now enforce intended restrictions in test scenarios matching the original CVSS vector.

Typical attack path

1. Gain local low-privileged access to a host running the vulnerable ASP.NET Core runtime
2. Execute code or commands that invoke the flawed authorization path
3. Read or exfiltrate data that should have been protected

How to detect it

Review local process execution logs, file-access audit trails, and ASP.NET Core diagnostic logs for unexpected reads of protected resources by low-privileged accounts; correlate with any post-authentication data exfiltration attempts.

What your security team should do

• Prioritize upgrade of all dotnet/core instances to the listed fixed commit within the next maintenance window
• Reduce local attack surface by enforcing least-privilege access and application sandboxing
• Audit deployed ASP.NET Core applications for custom authorization logic that may mask or compound the bypass