How I Found the Worst ASP.NET Vulnerability — A $10K Bug (CV...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.praetorian.com/blog/how-i-found-the-worst-asp-net-vulnerability-a-10k-bug-cve-2025-55315/
• Blog Title: How I Found the Worst ASP.NET Vulnerability — A $10K Bug (CVE-2025-55315)
• Suggested Section: Pentesting Web -> HTTP Request Smuggling (add a subsection: Chunked extension LF parsing / TERM.EXT; Kestrel CVE-2025-55315 variant)

🎯 Content Summary

CVE-2025-55315 is a high-severity (CVSS 9.9) HTTP/1.1 request-smuggling flaw in ASP.NET Core Kestrel caused by lenient parsing of chunked transfer-encoding extensions. Kestrel’s HTTP/1 chunk parser accepts a lone line feed (\n) inside the chunk-extension field and continues scanning until it encounters \r\n, while many front-end proxies treat a lone \n as a line terminator. This front/back-end parsing d...

🔧 Technical Details

Chunk-extension newline abuse (TERM.EXT): In HTTP/1.1 chunked requests, put a single \n inside the chunk-extension (after ;) so lenient back-ends keep scanning for \r\n while some proxies treat the \n as a line terminator. Place a second HTTP request after chunk framing; the proxy thinks these bytes are chunk data, but the back-end parses them as a pipelined request. This lets you tunnel restricted routes, capture victim requests, or poison caches across any stack where front/back-end extension parsing diverges.

🤖 Agent Actions

I analyzed the repository and found the best place to add this content is the existing Pentesting Web → HTTP Request Smuggling page:
src/pentesting-web/http-request-smuggling/README.md

What I did:

• Read relevant existing files to align structure and style:
  • src/pentesting-web/http-request-smuggling/README.md
  • src/pentesting-web/http-response-smuggling-desync.md
  • src/pentesting-web/http-connection-request-smuggling.md
  • src/pentesting-web/http-request-smuggling/browser-http-request-smuggling.md
  • src/pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.md
• Added a new subsection to document the TERM.EXT smuggling primitive exploiting chunked-extension LF parsing discrepancies, including:
  • Protocol notes (RFC 9112 and RFC 9110 token rules)
  • A minimal behavior probe demonstrating lenient chunk-extension LF handling
  • A concrete smuggling payload showing front-end vs back-end parsing views
  • Impact summary (bypass FE controls, request hijacking, cache poisoning)
  • Root cause and fix details for Kestrel (ParseExtension bug and InsecureChunkedParsing switch)
  • Detection guidance (Burp Request Smuggler ≥ 3.0.2 and manual validation)
  • Mitigations
• Updated the References section with the relevant sources:
  • Praetorian’s blog (CVE-2025-55315)
  • RFC 9112 and 9110 sections
  • Funky Chunks (TERM.EXT background)
  • Andrew Lock’s detailed write-up

Files modified:

• src/pentesting-web/http-request-smuggling/README.md
  • Added section: “Chunked extension LF parsing (TERM.EXT) — Kestrel CVE-2025-55315”
  • Appended new references to “## References”

No new files were created.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 907
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.praetorian.com/blog/how-i-found-the-worst-asp-net-vulnerability-a-10k-bug-cve-2025-55315/

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> HTTP Request Smuggling (add a subsection: Chunked extension LF parsing / TERM.EXT; Kestrel CVE-2025-55315 variant)".

Repository Maintenance:

• MD Files Formatting: 907 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0