[CodeThreat] Update Microsoft.Owin from 4.0.1 to 4.1.1

[serhanoztuna]

This PR was generated by CodeThreat utilizing authenticated user credentials.

Issue Description

A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.

The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.

The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.

Changes included in this PR

• Modifications to the following files to address the vulnerabilities with updated dependencies:
  • src/NETMVCBlot/packages.config

Security Issues Addressed

Through Dependency Upgrades:

Issue	Upgrade	Severity
dotnet: ASP.NET cookie prefix spoofing vulnerability	Microsoft.Owin: 4.0.1 -> 4.1.1	HIGH

Review the modifications in this PR to confirm they do not introduce any issues to your project.

[github-actions]

🚀 CodeThreat Security Scan Completed for IssueBlot.NET

Hello Team,

Great news! We've just completed a thorough security scan for IssueBlot.NET, and here's what we found:

---

⏱ Quick Overview

• Duration: 00:18:19
• Risk Score: F (This reflects the overall security posture based on the identified issues.)
• Issues Fixed: 0 (The number of vulnerabilities resolved during this scan.)

---

🛠 Detailed Vulnerability Analysis

We've identified vulnerabilities across the codebase. Here's a detailed look:

Weakness Name	Severity	Count
Sql Injection	Critical	23
Empty Catch Block	Low	8
Insecure Deserialization Binary	Critical	3
Insecure Cryptographic Hash	Critical	15
Insecure Pbe Work Factor	High	3
Custom Ssl Validation	Critical	1
Insecure Rsa Padding	Critical	2
Insecure Symmetric Encryption Mode Cbc Without Hmac	High	9
Insufficient Encryption Key Size	Critical	1
User Driven Insecure Hash Algorithm	Critical	1
Use Of Dangerous Regular Expressions	High	5
Lack Of Equals Implementation	Low	3
Inadequate Deserialization Validation	Low	3
Insecure Reflection	Medium	7
Resource Denial Of Service	Critical	3
Insecure Native Code Interaction	Low	1
Unnecessary Code Entrance	Low	3
Implementing Icloneable Interface	Low	1
Insecure Serialization Delegate	Critical	1
Writable Public Static Fields	Medium	2
Incorrect Readonly Member	Low	1
Incorrect Call To Equals With Array	Low	2
Possible Divide By Zero	Low	2
Directory Traversal	Critical	3
Unsafe Filesystem Resource Release	High	1
Insecure Deserialization Xml	Critical	1
Possibly Insecure Use Of Gethostbyaddress	Low	1
Insecure Basic Authentication	Critical	2
Insecure Ldap Simplebind	Critical	2
Ldap Resource Injection	Medium	4
Credential Exposure Log Files	High	2
Log Forging For Apache Log4net	Medium	3
Http Parameter Pollution	Critical	3
Network Connection Identifier Injection	High	4
Server Side Request Forgery	Critical	14
Xpath Injection	Critical	1
Connection String Injection	Critical	3
Unsafe Database Resource Release	High	2
Json Injection	Critical	1
Executable Injection	Medium	1
Code Injection	Critical	1
Xml Injection	High	1
Nhibernate Sql Injection	Critical	1
Ldap Injection	Critical	5
Exposing Unmasked Sensitive Data	High	2
Cross Site Request Forgery	Medium	10
Using Persistent Cookies	Low	1
Insecure Cors Configuration	Critical	1
Disabled Request Validation	High	1
Inadequate Input Validation Mvc Web Api	Medium	4
Mass Assignment	Critical	1
Http Cookie Injection	High	3
Insecure File Upload	Critical	4
Open Redirect	High	3
Http Response Splitting	Critical	3
Possibly Insecure Use Of Path Combine	High	4
Inadequate Input Validation Webforms	Medium	8
Sensitive Information Exposure	Medium	1
Potential Unsafe Decoding	Medium	5
Insecure Leakage Of System Information	Low	2
Hardcoded Credentials	Low	24
Insecure Random Number Generator	High	9
Unsafe Debug Directive	Low	3
Unsafe Version Leakage Directive	Low	3
Disabled Event Validation	High	1
Disabled Viewstate Mac Validation	High	2
Insecure Allowanonymousimpersonation Directive	Medium	1
Insecure Smtp Ssl Configuration	Critical	1
Missing Httponly Cookie Attribute	Critical	2
Insecure Hostheaderforrequesturl Directive	Low	1
Insecure Principal Permission Mode	High	1
Empty Password In Configuration	Medium	4
Insecure Msmq Authentication Mode	High	1
Session Fixation	High	1
Insecure Certificate Validation Mode	Critical	5
Insecure Database Connection Strings	Critical	4
Missing Fail Safe Error Handling	Medium	1
Insecure Maxjsondeserializermembers Directive	Low	1
Insecure Service Metadata Directive	Medium	2
Insecure Plaintext Passwords Forms Authentication	High	1
Insecure State Server Network Timeout Directive	Low	1
Insecure Ws Http Binding Security Mode	Critical	2
Insecure Storage Of Roles In Cookies	Medium	1
Insecure Include Exception Detail In Faults Directive	Low	1
Insecure Allowrelaxedrelativeurl Directive	High	1
Disabled Signature Validation	High	1
Insecure Request Validation Mode	High	1
Insecure Directory Browse Directive	Medium	2
Insecure Password Storage Forms Authentication	Medium	2
Insecure Javascriptdonotencodeampersand Directive	Medium	1
Insecure Maxhttpcollectionkeys Value	Medium	1
Insecure Suppress Audit Failure Directive	Low	1
Insecure Documentation Protocol Directive	Medium	1
Insecure Header Checking Directive Disabled	Medium	1
Xml External Entity Parsing	Critical	1
Unsafe Trace Directive	Low	1
Insecure Certificate Revocation Mode	High	1
Insecure Legacy Forms Authentication	Critical	1
Insecure Allowutf7requestcontentencoding Directive	Medium	1
Insecure Session Timeout	Medium	1
Missing Secure Cookie Attribute	Medium	2
Insecure Allowrelaxedunicodedecoding Directive	Low	1
Wcf Possible Unsafe Diagnostics	Low	1
Disabled Viewstate Encryption	High	1
Missing Cookie Protection	High	1
Insecure Relaxedhttpusername Directive	Medium	1
Impersonation In Code	Medium	1
Insecure Scriptresourceallownonjsfiles Directive	High	1
Insecure Elmah Configuration For Remote Access	High	4
Unsafe Dynamic Method Call	Critical	42
Prevent Dynamic Prototype Modification	High	21
Node Js Property Injection Defense	High	6

---

🔗 Software Composition Analysis (SCA) Insights

src/NETMVCBlot/packages.config

Severity Summary: Critical: 0 High: 6 Medium: 7 Low: 1

• Dependency: jQuery
  • jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
  • jquery: Untrusted code execution via
  • jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
  • jquery: Untrusted code execution via
• Dependency: Microsoft.Owin
  • dotnet: ASP.NET cookie prefix spoofing vulnerability
  • dotnet: malicious content causes high CPU and memory usage
• Dependency: Newtonsoft.Json
  • Improper Handling of Exceptional Conditions in Newtonsoft.Json
  • Improper Handling of Exceptional Conditions in Newtonsoft.Json
• Dependency: bootstrap
  • Bootstrap Cross-Site Scripting (XSS) vulnerability
  • Bootstrap Cross-Site Scripting (XSS) vulnerability
• Dependency: jQuery.Validation
  • jquery-validate: jquery.validate.js vulnerable to ReDoS
  • Regular expression denial of service in jquery-validation
• Dependency: Microsoft.Owin.Security.Cookies
  • dotnet: malicious content causes high CPU and memory usage
• Dependency: RazorEngine
  • Code injection in RazorEngine
• Dependency: Antlr
• Dependency: EntityFramework
• Dependency: Microsoft.AspNet.Cors
• Dependency: Microsoft.AspNet.Identity.Core
• Dependency: Microsoft.AspNet.Identity.EntityFramework
• Dependency: Microsoft.AspNet.Identity.Owin
• Dependency: Microsoft.AspNet.Mvc
• Dependency: Microsoft.AspNet.Razor
• Dependency: Microsoft.AspNet.Web.Optimization
• Dependency: Microsoft.AspNet.WebApi
• Dependency: Microsoft.AspNet.WebApi.Client
• Dependency: Microsoft.AspNet.WebApi.Core
• Dependency: Microsoft.AspNet.WebApi.Cors
• Dependency: Microsoft.AspNet.WebApi.WebHost
• Dependency: Microsoft.AspNet.WebPages
• Dependency: Microsoft.CodeDom.Providers.DotNetCompilerPlatform
• Dependency: Microsoft.Owin.Host.SystemWeb
• Dependency: Microsoft.Owin.Security
• Dependency: Microsoft.Owin.Security.OAuth
• Dependency: Microsoft.SharePoint.Client
• Dependency: Microsoft.SharePoint.dll
• Dependency: Microsoft.Web.Infrastructure
• Dependency: Microsoft.WebSockets
• Dependency: Microsoft.jQuery.Unobtrusive.Validation
• Dependency: Modernizr
• Dependency: Owin
• Dependency: SharePoint
• Dependency: SharePoint.Client.Search
• Dependency: SharePoint.Client.ServerRuntime
• Dependency: SharePoint.Search
• Dependency: System.Net.WebSockets
• Dependency: WebGrease

src/NETWebFormsBlot/packages.config

Severity Summary: Critical: 0 High: 2 Medium: 6 Low: 0

• Dependency: jQuery
  • jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
  • jquery: Untrusted code execution via
  • jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
  • jquery: Untrusted code execution via
• Dependency: Newtonsoft.Json
  • Improper Handling of Exceptional Conditions in Newtonsoft.Json
  • Improper Handling of Exceptional Conditions in Newtonsoft.Json
• Dependency: bootstrap
  • Bootstrap Cross-Site Scripting (XSS) vulnerability
  • Bootstrap Cross-Site Scripting (XSS) vulnerability
• Dependency: Antlr
• Dependency: AspNet.ScriptManager.bootstrap
• Dependency: AspNet.ScriptManager.jQuery
• Dependency: Microsoft.AspNet.FriendlyUrls
• Dependency: Microsoft.AspNet.FriendlyUrls.Core
• Dependency: Microsoft.AspNet.ScriptManager.MSAjax
• Dependency: Microsoft.AspNet.ScriptManager.WebForms
• Dependency: Microsoft.AspNet.Web.Optimization
• Dependency: Microsoft.AspNet.Web.Optimization.WebForms
• Dependency: Microsoft.CodeDom.Providers.DotNetCompilerPlatform
• Dependency: Microsoft.Web.Infrastructure
• Dependency: Modernizr
• Dependency: WebGrease

📈 Next Steps & Full Report

To dive deeper, click here to view the full report. It's essential to review these findings and plan the necessary fixes. If any of the critical/high issues need more discussion, let's set up a quick meeting to strategize our next steps.

---

🔒 Security isn't just a feature; it's a responsibility. Let's keep our codebase rock solid!

[codethreat-sast-cloud]

🚀 CodeThreat Security Scan Completed for IssueBlot.NET

Hello Team,

Great news! We've just completed a thorough security scan for IssueBlot.NET, and here's what we found:

---

⏱ Quick Overview

• Duration: 00:33:58
• Risk Score: F (This reflects the overall security posture based on the identified issues.)
• Issues Fixed: 0 (The number of vulnerabilities resolved during this scan.)

---

🛠 Detailed Vulnerability Analysis

We've identified vulnerabilities across the codebase. Here's a detailed look:

Weakness Name	Severity	Count
Sql Injection	Critical	23
Empty Catch Block	Low	8
Insecure Deserialization Binary	Critical	3
Insecure Cryptographic Hash	Critical	9
Insecure Pbe Work Factor	High	3
Custom Ssl Validation	Critical	1
Insecure Rsa Padding	Critical	2
Insecure Symmetric Encryption Mode Cbc Without Hmac	High	9
Insufficient Encryption Key Size	Critical	1
User Driven Insecure Hash Algorithm	Critical	1
Use Of Dangerous Regular Expressions	High	6
Lack Of Equals Implementation	Low	3
Inadequate Deserialization Validation	Low	3
Insecure Reflection	Medium	7
Resource Denial Of Service	Critical	3
Insecure Native Code Interaction	Low	1
Unnecessary Code Entrance	Low	3
Implementing Icloneable Interface	Low	1
Insecure Serialization Delegate	Critical	1
Writable Public Static Fields	Medium	2
Incorrect Readonly Member	Low	1
Incorrect Call To Equals With Array	Low	2
Possible Divide By Zero	Low	2
Directory Traversal	Critical	2
Unsafe Filesystem Resource Release	High	1
Insecure Deserialization Xml	Critical	1
Possibly Insecure Use Of Gethostbyaddress	Low	1
Insecure Basic Authentication	Critical	2
Insecure Ldap Simplebind	Critical	2
Ldap Resource Injection	Medium	4
Credential Exposure Log Files	High	2
Log Forging For Apache Log4net	Medium	3
Http Parameter Pollution	Critical	3
Network Connection Identifier Injection	High	13
Xpath Injection	Critical	1
Connection String Injection	Critical	3
Unsafe Database Resource Release	High	2
Server Side Request Forgery	Critical	5
Json Injection	Critical	1
Executable Injection	Medium	1
Code Injection	Critical	1
Xml Injection	High	1
Nhibernate Sql Injection	Critical	1
Ldap Injection	Critical	5
Exposing Unmasked Sensitive Data	High	2
Cross Site Request Forgery	Medium	10
Using Persistent Cookies	Low	1
Insecure Cors Configuration	Critical	1
Disabled Request Validation	High	1
Inadequate Input Validation Mvc Web Api	Medium	4
Mass Assignment	Critical	1
Http Cookie Injection	High	3
Insecure File Upload	Critical	4
Open Redirect	High	3
Http Response Splitting	Critical	3
Possibly Insecure Use Of Path Combine	High	4
Inadequate Input Validation Webforms	Medium	8
Sensitive Information Exposure	Medium	1
Potential Unsafe Decoding	Medium	5
Insecure Leakage Of System Information	Low	2
Hardcoded Credentials	Low	18
Insecure Random Number Generator	High	9
Unsafe Debug Directive	Low	3
Unsafe Version Leakage Directive	Low	3
Disabled Event Validation	High	1
Disabled Viewstate Mac Validation	High	2
Insecure Allowanonymousimpersonation Directive	Medium	1
Insecure Hostheaderforrequesturl Directive	Low	1
Insecure Smtp Ssl Configuration	Critical	1
Missing Httponly Cookie Attribute	Critical	2
Insecure Principal Permission Mode	High	1
Empty Password In Configuration	Medium	4
Session Fixation	High	1
Insecure Msmq Authentication Mode	High	1
Insecure Certificate Validation Mode	Critical	5
Missing Fail Safe Error Handling	Medium	1
Insecure Database Connection Strings	Critical	4
Insecure Maxjsondeserializermembers Directive	Low	1
Insecure Service Metadata Directive	Medium	2
Insecure Ws Http Binding Security Mode	Critical	2
Insecure Plaintext Passwords Forms Authentication	High	1
Insecure State Server Network Timeout Directive	Low	1
Insecure Storage Of Roles In Cookies	Medium	1
Insecure Include Exception Detail In Faults Directive	Low	1
Insecure Allowrelaxedrelativeurl Directive	High	1
Insecure Request Validation Mode	High	1
Disabled Signature Validation	High	1
Insecure Directory Browse Directive	Medium	2
Insecure Password Storage Forms Authentication	Medium	2
Insecure Javascriptdonotencodeampersand Directive	Medium	1
Insecure Maxhttpcollectionkeys Value	Medium	1
Insecure Suppress Audit Failure Directive	Low	1
Insecure Header Checking Directive Disabled	Medium	1
Xml External Entity Parsing	Critical	1
Insecure Documentation Protocol Directive	Medium	1
Insecure Certificate Revocation Mode	High	1
Unsafe Trace Directive	Low	1
Insecure Session Timeout	Medium	1
Insecure Legacy Forms Authentication	Critical	1
Insecure Allowutf7requestcontentencoding Directive	Medium	1
Missing Secure Cookie Attribute	Medium	2
Wcf Possible Unsafe Diagnostics	Low	1
Insecure Allowrelaxedunicodedecoding Directive	Low	1
Disabled Viewstate Encryption	High	1
Missing Cookie Protection	High	1
Insecure Relaxedhttpusername Directive	Medium	1
Impersonation In Code	Medium	1
Insecure Scriptresourceallownonjsfiles Directive	High	1
Insecure Elmah Configuration For Remote Access	High	4

---

🔗 Software Composition Analysis (SCA) Insights

src/NETMVCBlot/packages.config

Severity Summary: Critical: 0 High: 195 Medium: 273 Low: 39

src/NETWebFormsBlot/packages.config

Severity Summary: Critical: 0 High: 80 Medium: 112 Low: 16

📈 Next Steps & Full Report

To dive deeper, click here to view the full report. It's essential to review these findings and plan the necessary fixes. If any of the critical/high issues need more discussion, let's set up a quick meeting to strategize our next steps.

---

🔒 Security isn't just a feature; it's a responsibility. Let's keep our codebase rock solid!