CVE-2026-47300: Elevation of Privilege in ASP.NET Core Negotiate Authentication Handler

The security flaw identified as CVE-2026-47300 is a high-severity elevation of privilege vulnerability in Microsoft ASP.NET Core's Negotiate Authentication Handler (Microsoft.AspNetCore.Authentication.Negotiate). This module handles Kerberos and NTLM authentication, enabling single sign-on capabilities for ASP.NET Core applications. In cross-platform Linux and macOS deployments, the handler relies on an Active Directory or Lightweight Directory Access Protocol (LDAP) service to perform user group resolution and map memberships to application role claims.

When the option EnableLdap is set to true, the handler acts as an intermediary querying the directory service. The vulnerability exposes a critical attack surface where authenticated users can influence LDAP queries or redirect the directory lookup mechanism. This allows low-privileged users to manipulate the claims resolution process and gain unauthorized privileges.

This vulnerability is classified under CWE-303: Incorrect Implementation of Authentication Algorithm. The improper validation of user-asserted identity properties leads directly to administrative privilege mapping.

The vulnerability stems from three structural deficiencies in the LDAP group resolution workflow of the Negotiate handler. The primary mechanism involves the dynamic assembly of LDAP search filters using client-asserted identity strings. The handler failed to escape or sanitize input variables, such as user principal names or account names, prior to interpolating them into LDAP search templates.

An attacker can supply input containing RFC 4515 control characters like asterisks, parentheses, and backslashes to alter the logical evaluation of the query. By restructuring the query, the attacker forces the directory server to return records associated with high-privileged accounts instead of their own. The application then consumes the group attributes of the matched administrative account and populates them into the attacker's session context.

Additionally, the handler suffers from dynamic domain resolution weaknesses. When processing credentials from multi-domain forests, the handler extracts the domain suffix to establish connections to the corresponding domain controller. Because the handler does not validate the resolved target domain controller against a list of trusted entities, an attacker can input an external domain, forcing the ASP.NET Core server to connect to an untrusted LDAP directory which serves spoofed administrative group memberships.

The vulnerable implementation constructed LDAP search filters by direct string formatting. The following pseudo-code illustrates how the untrusted username was interpolated into the directory query without safety boundaries:

// VULNERABLE
public string BuildUserFilter(string username)
{
    // Direct string interpolation allows LDAP injection
    return $"(&(objectClass=user)(sAMAccountName={username}))";
}

If an attacker authenticated as victim_user)(memberOf=Domain Admins, the resultant query was structured as (&(objectClass=user)(sAMAccountName=victim_user)(memberOf=Domain Admins)). This modified query executed a logical AND operation requiring the victim user to be a member of the Domain Admins group.

To correct this, the framework was updated to implement robust escaping conformant with RFC 4515. The patch ensures that all special characters are translated to their equivalent hexadecimal values before the query is processed:

// PATCHED
public string BuildUserFilterSecure(string username)
{
    string escapedUsername = EscapeLdapFilter(username);
    return $"(&(objectClass=user)(sAMAccountName={escapedUsername}))";
}
 
private string EscapeLdapFilter(string filter)
{
    if (string.IsNullOrEmpty(filter)) return filter;
    StringBuilder sb = new StringBuilder(filter.Length);
    foreach (char c in filter)
    {
        switch (c)
        {
            case '\\': sb.Append("\\5c"); break;
            case '*':  sb.Append("\\2a"); break;
            case '(':  sb.Append("\\28"); break;
            case ')':  sb.Append("\\29"); break;
            case '\0': sb.Append("\\00"); break;
            default:   sb.Append(c); break;
        }
    }
    return sb.ToString();
}

Furthermore, the official patch updated upstream dependency packages to ensure that Microsoft Identity Web projects use rigid validation routines. The fix is comprehensive for LDAP filter injection but requires administrators to ensure that the server environment's root certificates and network-level firewalls limit domain controller connections to trusted boundaries.

Exploiting this vulnerability requires a valid, low-privileged domain account within the Active Directory forest or a trusted external domain. The attacker initiates a standard authentication handshake over HTTP with the ASP.NET Core server using SPNEGO/Kerberos. Since the vulnerability is located in the backend LDAP group query mechanism, the exploit triggers immediately after successful initial authentication.

The attacker manipulates their account credentials or registers an external account containing structural LDAP payload delimiters. When the application parses the authenticated user principal, it extracts the payload and sends the raw, unescaped LDAP query to the directory. The backend domain controller processes the malformed search criteria and returns administrative groups, which the application maps directly to the attacker's HTTP identity principal.

Alternatively, in a dynamic resolution scenario, the attacker configures an external malicious LDAP server under their control. By authenticating with a user identity indicating the malicious domain, the attacker triggers the ASP.NET Core application to establish an LDAP connection to the malicious server. The malicious server then responds with spoofed claims containing administrative roles, satisfying the application-level permission checks.

The CVSS base score of 8.8 reflects the high severity of the vulnerability. Because exploitation requires valid, low-privileged authentication credentials, the Privileges Required metric is designated as Low (PR:L). However, because the exploit operates entirely over the network and requires zero user interaction, the Attack Vector is Network (AV:N) and Attack Complexity is Low (AC:L).

The impact on confidentiality, integrity, and availability is designated as High (C:H/I:H/A:H) because successful exploitation elevates the attacker's privileges to administrative levels. The attacker gains the capability to perform restricted administrative operations, bypass authorization controls, access sensitive database records, and execute arbitrary configuration alterations on the hosting server.

While the Exploit Prediction Scoring System indicates a low immediate probability of active exploitation, the risk remains substantial in corporate environments utilizing multi-forest topologies or hybrid deployments. The lack of public proof-of-concept material does not diminish the severity, as the injection mechanics rely on standard and well-understood directory query manipulation techniques.

Remediation requires updating the underlying framework to a secure version. System administrators must upgrade .NET environments to versions 8.0.29, 9.0.18, or 10.0.6 depending on the major version in use. Development environments running Visual Studio must update to the respective fixed patch releases to prevent compiling against vulnerable software development kits.

If immediate deployment of patched frameworks is impossible, several mitigations can restrict the attack surface. Disabling LDAP role queries in the Negotiate configuration options prevents the application from making the vulnerable dynamic directory requests. Developers can implement alternative, secure claims-transformation routines that do not construct dynamic LDAP queries using client-supplied input.

Network administrators should restrict outgoing traffic from application servers to known, authorized LDAP servers and domain controllers. Blocking outbound connections on LDAP ports 389 and 636 to untrusted external networks prevents the dynamic redirection vector entirely. System log auditing should be configured on domain controllers to detect queries containing structural LDAP characters or unusual wildcard searches targeting user identities.