pentester.land· Aug 8, 2023· by Soroush Dalili (@irsdl)🔍 CVE-2023-36899

Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework (CVE-2023-36899 & CVE-2023-36560)

Target Program: -

🎯 Vulnerability: Web Security Vulnerability

💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.

#Authentication bypass#Privilege escalation#CVE-2023-36899#CVE-2023-36560