Insertion of sensitive information into sent data in .NET Aspire allows an authorized attacker to elevate privileges locally.

Affected: NuGet: Aspire.Hosting.AppHost, NuGet: Aspire.Hosting

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in Aspire. This advisory provides guidance on updating affected applications and components.

Disclosure of an Aspire Dashboard authentication cookie to a linked service can allow an attacker-controlled container to replay the authenticated session and execute code as the host developer.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/503

## CVSS Details

- **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H` - **Weakness:** CWE-201 (Insertion of Sensitive Information Into Sent Data)

## Affected Platforms

- **Platforms:** macOS - **Architectures:** x64, Arm64

## <a name="affected-packages"></a>Affected Packages

### Standalone Aspire

Package | Affected version | Patched version --- | --- | --- [Aspire.Hosting.AppHost](https://www.nuget.org/packages/Aspire.Hosting.AppHost) | < 13.6.5 | 13.6.5 [Aspire.Hosting](https://www.nuget.org/packages/Aspire.Hosting) | < 13.6.5 | 13.6.5

The affected scenario involves a Dashboard-authenticated AppHost workflow with an attacker-controlled container and a linked HTTPS YARP gateway. The affected hosting code is in `Aspire.Hosting`, a dependency of `Aspire.Hosting.AppHost`. `Aspire.AppHost.Sdk` supplies the AppHost package implicitly unless the project overrides the default references.

## Advisory FAQ…