CVE-2025-55315 | (CVSS 9.9) – Critical HTTP Request Smuggling in ASP. NET Kestrel (HTTP/1.1, non-TLS)

[amitlttwo]

Is there an existing template for this?

• I have searched the existing templates.

Template requests

CVE-2025-55315

Vulnerable System Behavior:

• GET requests: Returns HTTP 200 with socket remaining open
• POST requests: Returns HTTP 200 with socket remaining open
• POST to content-type endpoints: Returns HTTP 415 with socket remaining open

Patched System Behavior:

• GET requests: Returns HTTP 200 but socket closes immediately
• POST requests: Returns HTTP 400 "Bad chunk extension" and socket closes
• POST to content-type endpoints: Returns HTTP 415 but socket closes immediately

Author

Amit Kumar Biswas (@amitlt2), Security Engineer at VIEH Group - https://github.com/amitlttwo & https://github.com/viehgroup

Affected Configurations

• ASP.NET Kestrel webserver with HTTP/1.1
• Non-TLS configurations (HTTP)
• Versions before the security patch

Detection Indicators

• Different connection behavior (keep-alive vs immediate closure)
• Status code variations (200 vs 400)
• Exception messages about "Bad chunk extension"
• Server headers containing "Kestrel" or "ASP.NET"

Template Code

id: CVE-2025-55315

info:
  name: ASP.NET Kestrel HTTP Request Smuggling Vulnerability
  author: @amitlt2 & @viehgroup
  severity: Critical
  description: Detection for CVE-2025-55315 - Critical HTTP request/response smuggling vulnerability in ASP.NET Kestrel webserver
  reference:
    - https://github.com/dotnet/aspnetcore/commit/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55315
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2025-55315
  tags: cve,cve2025,http,kestrel,aspnet,dotnet,smuggling

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    
    headers:
      Host: "{{Hostname}}"
      Transfer-Encoding: chunked
      Content-Type: text/plain
      Connection: keep-alive
    
    body: "2;\rxx\r\nxy\r\n0\r\n\r\n"
    
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "HTTP/1.1 200 OK"
          - "ASP.NET"
        condition: or
        part: header

      - type: word
        words:
          - "Kestrel"
        part: body

  - method: POST
    path:
      - "{{BaseURL}}"
    
    headers:
      Host: "{{Hostname}}"
      Transfer-Encoding: chunked
      Content-Type: text/plain
    
    body: "2;\rxx\r\nxy\r\n0\r\n\r\n"
    
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
          - 415

      - type: word
        words:
          - "HTTP/1.1"
        part: header

  - method: POST
    path:
      - "{{BaseURL}}/ct"
    
    headers:
      Host: "{{Hostname}}"
      Transfer-Encoding: chunked
      Content-Type: text/plain
    
    body: "2;\rxx\r\nxy\r\n0\r\n\r\n"
    
    matchers:
      - type: status
        status:
          - 415
          - 200

  - method: GET
    path:
      - "{{BaseURL}}"
    
    headers:
      Host: "{{Hostname}}"
      Transfer-Encoding: chunked
      Content-Type: text/plain
    
    body: "2;\rxx\r\nxy\r\n0\r\n\r\n"
    
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200 && contains(all_headers, 'Kestrel')"
          - "status_code == 200 && contains(body, 'ASP.NET')"


## References
- https://github.com/dotnet/aspnetcore/commit/ (security fix commit)
- https://nvd.nist.gov/vuln/detail/CVE-2025-55315
- PoC Blog: Abbreviated Reproduction of CVE-2025-55315

[DhiyaneshGeek]

Hi @amitlttwo

Thanks for sharing the template and contributing to the template project,

After the initial review , it was observed that it has only status code as matcher, which will result in lot of false positive.

Can you share the source / reference of this POC ?

Looking forward to hear back from you

Thanks

[amitlttwo]

Thank you for the feedback. The template has been updated with enhanced detection to reduce false positives.

Key Improvements:

• Specific Kestrel server identification
• Unique error message detection ("Bad chunk extension")
• Behavioral analysis of chunk extension handling
• Multi-layer verification requiring concurrent indicators

The detection methodology is based on internal VIEH Security Research Team comparing vulnerable vs patched Kestrel behavior with malformed chunk extensions.

The updated template now provides accurate detection while maintaining low false positive rates through precise matchers and server-specific verification.

Here is the updated Template

id: CVE-2025-55315

info:
  name: ASP.NET Kestrel HTTP Request Smuggling Vulnerability
  author: amitlt2 & viehgroup
  severity: critical
  description: Detection for CVE-2025-55315 - Critical HTTP request/response smuggling vulnerability in ASP.NET Kestrel webserver via malformed chunk extensions
  reference:
    - https://github.com/dotnet/aspnetcore/commit/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55315
    - https://www.viehgroup.com/blog/cve-2025-55315-poc
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2025-55315
  tags: cve,cve2025,http,kestrel,aspnet,dotnet,smuggling,http-smuggling

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    
    headers:
      Host: "{{Hostname}}"
      Transfer-Encoding: chunked
      Content-Type: text/plain
      Connection: keep-alive
    
    body: "2;\rxx\r\nxy\r\n0\r\n\r\n"
    
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "Server: Kestrel"
          - "Microsoft-HTTPAPI"
        condition: or

      - type: word
        part: body
        words:
          - "Bad chunk extension"
          - "Invalid non-ASCII"
        condition: or
        negative: true

  - method: POST
    path:
      - "{{BaseURL}}"
    
    headers:
      Host: "{{Hostname}}"
      Transfer-Encoding: chunked
      Content-Type: text/plain
    
    body: "2;\rxx\r\nxy\r\n0\r\n\r\n"
    
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
          - 400

      - type: word
        part: body
        words:
          - "Bad chunk extension"
          - "ASP.NET"
          - "Kestrel"
        condition: or

      - type: dsl
        dsl:
          - "status_code == 200 && contains(header, 'Kestrel')"
          - "status_code == 400 && contains(body, 'Bad chunk extension')"

  - method: POST
    path:
      - "{{BaseURL}}/ct"
      - "{{BaseURL}}/api"
      - "{{BaseURL}}/test"
    
    headers:
      Host: "{{Hostname}}"
      Transfer-Encoding: chunked
      Content-Type: text/plain
    
    body: "2;\rxx\r\nxy\r\n0\r\n\r\n"
    
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 415
          - 200

      - type: word
        part: header
        words:
          - "HTTP/1.1"
        condition: and

      - type: dsl
        dsl:
          - "contains(tolower(header), 'kestrel') || contains(tolower(body), 'asp.net')"

  - method: GET
    path:
      - "{{BaseURL}}"
    
    headers:
      Host: "{{Hostname}}"
      Transfer-Encoding: chunked
      Content-Type: text/plain
      Connection: close
    
    body: "2;\rxx\r\nxy\r\n0\r\n\r\n"
    
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200 && contains(tolower(all_headers), 'kestrel') && !contains(tolower(body), 'bad request')"
          - "status_code == 200 && contains(tolower(header), 'server:') && contains(tolower(header), 'kestrel')"

# Additional detection for connection behavior differences
  - method: GET
    path:
      - "{{BaseURL}}"
    
    headers:
      Host: "{{Hostname}}"
      Transfer-Encoding: chunked
      Content-Type: text/plain
    
    body: "2;\rxx\r\nxy\r\n0\r\n\r\n"
    
    race: true
    race_count: 2
    
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200 && contains(header, 'Kestrel') && !contains(body, '400') && !contains(body, 'Bad Request')"

Thanks