CyberRota Analysis
AI-GeneratedThe DotVVM framework versions prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final are vulnerable due to the AuthorizeActionFilter failing to perform necessary authorization checks, potentially exposing sensitive commands, view models, or presenters to unauthorized access. This critical vulnerability (CVSS 9.2) poses a significant risk to applications utilizing this framework, making it imperative for developers and organizations using DotVVM to prioritize upgrading to the patched versions. Immediate action is recommended to mitigate the risk of unauthorized access to protected resources.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync implementations return completed tasks instead of invoking the corresponding checks. Applications relying on this filter can therefore expose protected commands, view models, or presenters to unauthorized requests without any special bypass technique. AuthorizeAttribute correctly implements the same interfaces and can be used as a workaround. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.