ASP.NET Core web socket middleware for use on top of opaque servers.

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.websockets/2.0.1/microsoft.aspnetcore.websockets.2.0.1.nupkg

Vulnerable Library - system.text.encodings.web.4.4.0.nupkg

Provides types for encoding and escaping strings for use in JavaScript, HyperText Markup Language (H...

Library home page: https://api.nuget.org/packages/system.text.encodings.web.4.4.0.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.encodings.web/4.4.0/system.text.encodings.web.4.4.0.nupkg

Dependency Hierarchy:

• microsoft.aspnetcore.authentication.jwtbearer.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.2.0.1.nupkg
    • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
      • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
        • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
          • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.identity.entityframeworkcore.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.identity.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.cookies.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.2.0.1.nupkg
        • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
          • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
            • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
              • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.azureappservices.hostingstartup.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
    • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.session.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
    • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
      • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.responsecaching.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.http.2.0.1.nupkg
    • microsoft.aspnetcore.webutilities.2.0.1.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.spaservices.2.0.2.nupkg (Root Library)

  • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
    • microsoft.aspnetcore.html.abstractions.2.0.0.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.microsoftaccount.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
          • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
            • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.mvc.2.0.2.nupkg (Root Library)

  • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
    • microsoft.aspnetcore.html.abstractions.2.0.0.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.server.httpsys.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.core.2.0.1.nupkg
    • microsoft.aspnetcore.http.2.0.1.nupkg
      • microsoft.aspnetcore.webutilities.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.diagnostics.entityframeworkcore.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
    • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.middlewareanalysis.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
    • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.diagnostics.2.0.1.nupkg
    • microsoft.aspnetcore.webutilities.2.0.1.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.rewrite.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
    • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.facebook.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
          • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
            • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.localization.routing.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.routing.abstractions.2.0.1.nupkg
    • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.applicationinsights.hostingstartup.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.razor.runtime.2.0.1.nupkg
    • microsoft.aspnetcore.html.abstractions.2.0.0.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.openidconnect.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
          • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
            • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.dataprotection.azurestorage.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
    • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
      • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.websockets.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.http.extensions.2.0.1.nupkg
    • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.staticfiles.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
    • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.cookiepolicy.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.http.2.0.1.nupkg
    • microsoft.aspnetcore.webutilities.2.0.1.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.visualstudio.web.browserlink.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
    • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.mvc.formatters.xml.2.0.2.nupkg (Root Library)

  • microsoft.aspnetcore.mvc.core.2.0.2.nupkg
    • microsoft.aspnetcore.routing.2.0.1.nupkg
      • microsoft.aspnetcore.routing.abstractions.2.0.1.nupkg
        • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
          • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.owin.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.http.2.0.1.nupkg
    • microsoft.aspnetcore.webutilities.2.0.1.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.responsecompression.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.http.extensions.2.0.1.nupkg
    • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.google.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
          • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
            • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.dataprotection.extensions.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
    • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
      • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.mvc.razor.viewcompilation.2.0.2.nupkg (Root Library)

  • microsoft.aspnetcore.hosting.2.0.1.nupkg
    • microsoft.aspnetcore.http.2.0.1.nupkg
      • microsoft.aspnetcore.webutilities.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.twitter.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
          • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
            • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- dvcsharp_core_api.AuthorizationsController (Application)
    - Microsoft.AspNetCore.Mvc.Controller (Extension)
        - Microsoft.AspNetCore.Http.HttpContext (Extension)
            - Microsoft.AspNetCore.Http.HttpRequest (Extension)
                - Microsoft.AspNetCore.Http.QueryString (Extension)
                    -> ❌ System.Text.Encodings.Web.TextEncoder (Vulnerable Component)

Vulnerability Details

.NET Core Remote Code Execution Vulnerability

Publish Date: Feb 25, 2021 11:02 PM

URL: CVE-2021-26701

Threat Assessment

Exploit Maturity:Unproven

EPSS:1.7%

Score: 9.2

Suggested Fix

Type: Upgrade version

Origin: GHSA-ghhp-997w-qr28

Release Date: Feb 25, 2021 11:02 PM

Fix Resolution : System.Text.Encodings.Web - 4.7.2,System.Text.Encodings.Web - 5.0.1,System.Text.Encodings.Web - 4.5.1