GHSA-2288-8h3r-cqgg
CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| NuGet | CoreWCF.Primitives | >= 1.9.0, < 1.9.1 | 1.9.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
When the proof key recovered from the RSTR can be observed by a party that is not the legitimate client, that party can impersonate the authenticated Windows principal for the lifetime of the SCT (default ~10 hours) and decrypt or forge any subsequent WS‑SecureConversation traffic that uses keys derived from the SCT.
#### Preconditions
Using security mode TransportWithMessageCredential with client credential type Windows, along with session establishment (which triggers use of WS-SecureConversation).
### Patches
Fixed in CoreWCF v1.9.1
### Workarounds
Ensure communication is protected by SSL/TLS to prevent capturing of SCT negotiation handshake.
References
External links from the advisory. They lead to third-party sites.