Description

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:44.503Z",
  "pubdate": "2026-08-11T17:18:44.503Z",
  "executiveSummary": "An information disclosure vulnerability exists in .NET due to the inclusion of functionality from an untrusted control sphere. This security flaw allows an unauthorized, remote attacker to gain unauthorized access to sensitive system or application information over a network. The affected products include vulnerable versions of the .NET framework and core platforms where untrusted control inputs are improperly integrated. The primary risk implication involves the potential leakage of confidential data, which could facilitate further reconnaissance and subsequent attacks against the underlying infrastructure. Attacker capabilities include network-based exploitation without requiring prior authentication or elevated privileges, provided the application processes data from the untrusted control sphere. Exploitation requirements typically involve interacting with vulnerable endpoints or components that improperly handle external control vectors, leading to the unauthorized transmission or exposure of internal state data across the network boundary.",
  "technicalDetails": "The root cause of the vulnerability stems from the architectural flaw categorized as the inclusion of functionality from an untrusted control sphere within .NET applications. This occurs when a vulnerable component or function dynamically incorporates, executes, or evaluates data and code sourced from an untrusted domain without adequate validation, sanitization, or boundary enforcement. The vulnerable component typically resides within network-facing routines or data-processing modules that accept external parameters.\nExploitation is achieved by an unauthorized network attacker supplying maliciously crafted input designed to manipulate the control flow or data aggregation mechanisms of the application. Because the application trusts the untrusted control sphere or fails to isolate internal logic from external inputs, the execution path inadvertently processes sensitive data and exposes it through network responses or logging mechanisms.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies a network-exposed .NET endpoint or service that ingests parameters from an untrusted source. Second, the attacker crafts a specialized payload intended to trigger the vulnerable functionality inclusion path. Third, upon transmitting the payload over the network, the application processes the untrusted input within its execution context. Fourth, due to the lack of proper segmentation between trusted internal logic and untrusted control data, the application leaks sensitive information back to the attacker or transmits it across the network.\nThe vulnerability requires network exposure and typically does not mandate authentication or specific privilege levels, enabling unauthenticated remote attackers to execute the attack vector. The payload behavior centers on triggering unintended code paths or data retrieval routines, resulting in post-exploitation impact characterized by confidentiality breaches, exposure of internal architecture details, and potential leakage of credentials or sensitive operational data."
}