Microsoft has issued a critical security update for ASP.NET Core to address CVE-2025-55315, a high-severity flaw that enables HTTP request smuggling and could allow attackers to bypass key security controls.

Disclosed on October 14, 2025, this vulnerability has a CVSS v3.1 score of 9.9, making it one of the most severe issues ever reported in the ASP.NET ecosystem.

The flaw stems from inconsistent handling of HTTP requests in the Kestrel web server component, which could let authenticated attackers inject hidden requests to escalate privileges or access sensitive data.

While HTTP request smuggling is a well-known attack vector, this specific implementation in ASP.NET Core amplifies risks for web applications relying on the framework for authentication and authorization.

Attackers exploit discrepancies between how proxies and servers parse headers like Content-Length and Transfer-Encoding, smuggling malicious payloads that evade normal processing.

For instance, a crafted POST request might embed a concealed GET to an admin endpoint, tricking the system into executing unauthorized actions without detection.

Understanding HTTP Request Smuggling

At its core, HTTP request smuggling leverages parsing inconsistencies across network components, such as front-end proxies and back-end servers.

An attacker sends a request with ambiguous headers, like combining Content-Length and Transfer-Encoding, causing the proxy to interpret it one way while the server sees the smuggled content differently.

This can result in the second request bypassing rate limits, CSRF protections, or even authentication checks, leading to severe outcomes in multi-tiered environments.

In the CVE-2025-55315 case, the Kestrel server’s failure to validate request boundaries under certain conditions allows smuggled requests to reach application logic intact.

This affects all supported ASP.NET Core versions, including 8.0, 9.0, and 10.0 previews, particularly in setups with reverse proxies like NGINX or Azure Front Door.

Exploitation requires network access and often low privileges, but the scope can extend to confidential data exposure or server crashes in worst-case scenarios.

The vulnerability’s high score underscores its potential for chained attacks, from session hijacking to server-side request forgery.

Not all applications are equally exposed; risks heighten if custom request parsing, header-based decisions, or skipped validations are in play.

For regulated sectors handling sensitive data, unpatched systems could face compliance violations alongside direct threats like privilege escalation.

Mitigations

Microsoft urges immediate patching via the latest .NET updates for affected versions, followed by application restarts.

Developers should audit request-handling code, especially around auth and input validation, while ensuring proxies normalize traffic to block smuggling attempts.

Monitoring logs for anomalous patterns and testing with tools like those simulating HRS can further harden defenses. By applying these measures, organizations can safeguard ASP.NET applications against this pervasive threat landscape.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Microsoft Details ASP.NET Vulnerability That Enables Attackers To Smuggle HTTP Requests appeared first on Cyber Security News.

Docker Compose, a cornerstone tool for developers managing containerized application harbors a high-severity vulnerability that lets attackers overwrite files anywhere on a host system.

Discovered in early October 2025 by Imperva, the issue stems from improper handling of remote artifacts in Docker’s OCI support, enabling path traversal attacks without even launching containers.

Assigned CVE-2025-62725 with a CVSS score of 8.9, the flaw affects millions of workflows in CI/CD pipelines, local development, and cloud environments. Docker swiftly patched it in version 2.40.2, urging users to update immediately.

The vulnerability emerged as researchers probed Docker Compose’s new feature for OCI-based artifacts, which allows teams to share portable Compose projects via registries.

These artifacts use simple “include” directives in YAML files to pull in configurations, environment files, and extensions. Behind the scenes, Compose downloads layers from the registry and reconstructs them in a local cache directory, guided by annotations like com.docker.compose.file or com.docker.compose.envfile.

These annotations dictate file destinations, but the code in oci.go blindly concatenated them with the cache path, skipping normalization or boundary checks.

Attackers could craft malicious artifacts with annotations to escape the cache and target sensitive locations, such as SSH keys or system configs.

The danger lies in its stealth: it triggers during “read-only” operations like “docker compose config” or “docker compose ps,” which resolve remote includes without user intent to write files.

A proof-of-concept demonstrates injecting an SSH public key into ~/.ssh/authorized_keys, granting remote access—all from a tricked developer running a routine command on an untrusted YAML file.

This bug’s subtlety amplifies its threat. Developers often share Compose files in public repos or CI systems, unaware that a tampered “include” could fetch a poisoned artifact.

In enterprise settings, cloud dev environments or automated builds become prime targets, as the process leaks server IPs during fetches and writes files with the Compose binary’s permissions.

No container startup is needed, blurring the lines between safe inspection and exploitation. Impacts span Docker Desktop, Linux binaries, and integrated tools, potentially leading to full system compromise if the host runs as root or has broad write access.

Docker’s fix introduces a validatePathInBase function that normalizes paths and rejects traversals or absolute references. Reported on October 9, confirmed by October 21, and released on October 27, the patch closes the gap without disrupting OCI features.

Security experts emphasize auditing shared Compose files and running tools with the least privilege. As container orchestration evolves, this incident underscores the perils of trusting remote metadata, reminding developers that convenience must never outpace validation.

With updates applied, Docker Compose regains its trusted status, but vigilance remains key in an era of interconnected DevOps.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Docker Compose Vulnerability Allow Attacks To Overwrite Arbitrary Files appeared first on Cyber Security News.

A sophisticated new remote access trojan called Atroposia has emerged in underground cybercrime marketplaces, offering attackers a comprehensive toolkit for hidden remote desktop access, credential theft, and network manipulation at an accessible price point. Security researchers at Varonis recently discovered the malware being promoted on underground forums, highlighting how advanced cyberattack capabilities are increasingly packaged […]

The post New Atroposia RAT Uses Hidden Remote Desktop, Vulnerability Scanning and Advanced Persistence appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.