Microsoft .NET'dagi muhim Brotli zaifligi uchun shoshilinch yamoqlarni chiqardi

Microsoft .NET xavfsizlik yangilanishlarini shoshilinch tarzda chiqardi, bu muhim zaiflik Broccoli2Shell deb nomlanadi, shuningdek Node2Shell va HTTP2Shell sifatida ham kuzatiladi.

CVE-2026-111497 sifatida kuzatiladigan bu muhim darajadagi zaiflik Imperva Red Team tomonidan topilgan va Brotli dekoderidagi chegaradan tashqari yozuvdan kelib chiqadi, bu Google'ning keng tarqalgan Brotli yo'qotishsiz siqish algoritmi yordamida siqilgan ma'lumotlarni kengaytiradi.

Muvaffaqiyatli ekspluatatsiya huquqsiz hujumchilarga zararli tarzda tayyorlangan Brotli-siqlangan oqimdan foydalanib, avariyalarni yoki xotira sizib chiqishini keltirib chiqarish va ba'zi hollarda zaif Brotli binarlari yoki kutubxonalari bo'lgan qurilmalarda masofaviy kod bajarilishini olish imkonini beradi.

Microsoftning yakshanba kuni e'lon qilingan maslahatiga ko'ra, hujumchilar bu zaiflikdan foydalanib, yangilanmagan .NET o'rnatishlari bo'lgan tizimlarda masofaviy ravishda huquqlarni oshirishlari mumkin, agar ular standart bo'lmagan konfiguratsiyalardan foydalansa.

"Ilovalar Brotli-siqlangan ma'lumotlarni ASP.NET Core so'rov dekompressiyasi, HttpClient avtomatik javob dekompressiyasi yoki System.IO.Compression Brotli API'lari orqali qayta ishlasa, ta'sirlanishi mumkin," deb aytdi Microsoft.

"Brotli dekompressiyasi .NET yoki ASP.NET Core'ning standart o'rnatilishida sukut bo'yicha yoqilmagan. Ilovalar ASP.NET Core so'rov dekompressiyasi yoki HttpClient javob dekompressiyasini qo'lda yoqishi, yoki .NET tomonidan taqdim etilgan Brotli dekompressiya API'larini qo'lda chaqirishi kerak."

Bu zaiflikni bartaraf etish uchun Microsoft .NET 8, .NET 9 va .NET 10, shuningdek .NET 11 Release Candidate 3 uchun rejalashtirilmagan (OOB) xavfsizlik yangilanishlarini chiqardi va "iloji boricha tezroq yangilash"ni tavsiya qildi.

Broccoli2Shell uchun isbot-tushuncha (PoC) ekspluatatsiyalari allaqachon GitHub'da e'lon qilingan bo'lsa-da, yovuz maqsadli ekspluatatsiya haqida hech qanday xabarlar paydo bo'lmagan.

Zaiflikni kuzatuvchi maxsus onlayn portal tizim Brotli kutubxonasini yangilash o'z kutubxona nusxasini o'z ichiga olgan ilovalardagi xavfni bartaraf etmasligini ogohlantiradi.

Yangilanishlarni darhol qo'llay olmaydiganlar kiruvchi Brotli-siqlangan so'rovlarni proksi yoki fayervol yordamida bloklashlari, yoki yamoqni qo'llaguncha Brotli dekodlashni o'chirishlari kerak.

Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi.

Umumiy oldini olish ko'rsatkichlari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanganda, oldini olish keskin pasayadi.

Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika bo'yicha mudofaa choralarini o'lchaydi.

Hisobotni oling

Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.

Tracked as CVE-2026-111497, this critical-severity flaw was found by Imperva Red Team and stems from an out-of-bounds write in the Brotli decoder, which expands data compressed using Google's widely used Brotli lossless compression algorithm.

Successful exploitation lets unprivileged attackers use a maliciously crafted Brotli-compressed stream to trigger crashes or memory leaks and, in some cases, gain remote code execution on devices with vulnerable Brotli binaries or libraries.

According to a Microsoft advisory published Sunday, attackers can also exploit this flaw to remotely escalate privileges on systems with unpatched .NET installations that use non-default configurations.

"Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs," Microsoft said.

"Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompression, or they must manually invoke the Brotli decompression APIs provided by .NET."

To address this flaw, Microsoft has released out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3, and advised "updating as soon as possible."

While proof-of-concept (PoC) exploits for Broccoli2Shell have already been published on GitHub, no reports of malicious exploitation in the wild have emerged.

A dedicated online portal tracking the flaw warns that updating the system Brotli library doesn't address the risk in apps that bundle their own copy of the library.

Those who can't apply the updates immediately should block incoming Brotli-compressed requests using a proxy or firewall, or disable Brotli decoding until they can apply a patch.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report