Loading vulnerability…
CVE-2025-55315 is a critical security feature bypass vulnerability in ASP.NET Core caused by inconsistent interpretation of HTTP requests in the Kestrel web server component. The flaw is described as HTTP request/response smuggling, where a crafted request can cause different components in the request-processing chain to parse message boundaries differently, allowing an attacker to conceal a secondary request inside an apparently legitimate one. The issue affects supported ASP.NET Core releases, including Kestrel-based deployments and applications depending on the affected Kestrel package. Microsoft assigned the vulnerability a CVSS score of 9.9 and released fixes for supported runtime, SDK, and package versions. In vulnerable deployments, exploitation can let an attacker bypass front-end security assumptions and interfere with how downstream application logic interprets authenticated and unauthenticated traffic.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository is a comprehensive proof-of-concept (PoC) for CVE-2025-55315, a .NET Kestrel HTTP request smuggling vulnerability. The project is structured into several components: - **Api/**: Contains an ASP.NET Core API with two Dockerfiles: one for a vulnerable build (using .NET 10.0.100-rc.1) and one for a patched build (using .NET 10.0.100). The API exposes endpoints such as `/passwords/{username}`, `/passwords` (POST), and `/health`. - **PythonProxy/**: Implements a custom Python HTTP proxy (`proxy_server.py`) that demonstrates the vulnerability by favoring the `Content-Length` header over `Transfer-Encoding` when both are present, which is the root cause of the request smuggling issue. The proxy blocks direct requests to `/passwords/admin` but can be bypassed via a crafted HTTP request that exploits the parsing discrepancy. - **YarpProxy/**: Provides a YARP-based reverse proxy for load balancing, not directly involved in the exploit but useful for testing. - **docker-compose.yml**: Orchestrates all services, exposing them on different localhost ports (5001 for Unsafe API, 5002 for Safe API, 5027 for PythonProxy, 5028 for YarpProxy). The exploit works by sending a specially crafted HTTP request to the PythonProxy, which is then parsed differently by the proxy and the backend server, allowing a hidden request to `/passwords/admin` to be executed on the vulnerable backend. The repository includes detailed documentation, usage instructions, and sample exploit payloads. No fake or detection-only scripts are present; the code is a functional exploit PoC for the specified CVE.
This repository provides a professional penetration testing tool for exploiting CVE-2025-55315, a critical HTTP Request Smuggling vulnerability in Microsoft ASP.NET Core Kestrel web server (versions 3.0 through 9.0.9). The repository contains two files: a detailed README.md (documentation, usage, and legal warnings) and the main exploit script cve_2025_55315_PoC.py (Python 3). The exploit script is a single-target tool that performs reconnaissance, auto-discovers common ASP.NET Core endpoints, tests for the vulnerability, and can extract sensitive files (such as web.config) or upload a webshell for remote code execution. It supports both HTTP and HTTPS, custom ports, and provides detailed reporting. The tool is operational, requiring user confirmation for destructive actions, and is intended for authorized security testing only. The main attack vector is network-based, targeting HTTP(S) endpoints on the vulnerable server. The script does not rely on external dependencies and is suitable for use by penetration testers, researchers, and system administrators.
This repository contains a comprehensive Python exploit and research tool for CVE-2025-55315, a critical HTTP Request Smuggling vulnerability in Microsoft's ASP.NET Core Kestrel Web Server. The main file, 'CVE-2025-55315漏洞利用研究.py', is a large, feature-rich script that provides both vulnerability detection and exploitation capabilities. It supports multiple attack modes, including privilege escalation, information disclosure, data tampering, denial of service, and advanced payload delivery. The script is highly configurable, supporting stealth mode, proxy usage, multi-threading, and randomized user agents for evasion. It interacts with public vulnerability intelligence APIs (NVD, CISA, GitHub) for enrichment and reporting. The README provides usage instructions and legal disclaimers. No hardcoded target endpoints are present; the script is designed to be run against user-supplied URLs. The exploit is operational, with customizable payloads and attack vectors, and is suitable for both research and authorized penetration testing.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
148 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An HTTP request smuggling vulnerability in the Kestrel web server for ASP.NET Core that can allow authenticated attackers to hijack credentials, bypass front-end security controls, or crash the server.
A severe ASP.NET vulnerability in the Kestrel web server component, described as one of ASP.NET's worst recent flaws and rated CVSS 9.9.
Unknown
A critical vulnerability in Tenable Identity Exposure (on-premises LTS, versions prior to 3.77.14) with a CVSS score of 9.9, potentially allowing severe exploitation if unpatched.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.