### Impact The attacker, with one captured signed SOAP envelope from a victim and no other privileges, can invoke arbitrary operations on the service as the victim principal for the lifetime of the captured signing key. There is no rate limit on replays. The DetectReplays setting on transport-security bindings does not mitigate the issue because the attack does not reuse the original timestamp — the fresh timestamp in the wsse:Security header is what the replay-detection logic inspects. ### Patches Fixed in CoreWCF v1.8.1 and v1.9.1 ### Workarounds Ensure communication is protected by SSL/TLS to prevent capturing of signed SOAP envelope.
### Impact The attacker, with one captured signed SOAP envelope from a victim and no other privileges, can invoke arbitrary operations on the service as the victim principal for the lifetime of the captured signing key. There is no rate limit on replays. The DetectReplays setting on transport-security bindings does not mitigate the issue because the attack does not reuse the original timestamp — the fresh timestamp in the wsse:Security header is what the replay-detection logic inspects. ### Patches Fixed in CoreWCF v1.8.1 and v1.9.1 ### Workarounds Ensure communication is protected by SSL/TLS to prevent capturing of signed SOAP envelope.
### Impact The attacker, with one captured signed SOAP envelope from a victim and no other privileges, can invoke arbitrary operations on the service as the victim principal for the lifetime of the captured signing key. There is no rate limit on replays. The DetectReplays setting on transport-security bindings does not mitigate the issue because the attack does not reuse the original timestamp — the fresh timestamp in the wsse:Security header is what the replay-detection logic inspects. ### Patches Fixed in CoreWCF v1.8.1 and v1.9.1 ### Workarounds Ensure communication is protected by SSL/TLS to prevent capturing of signed SOAP envelope.
### Impact The attacker, with one captured signed SOAP envelope from a victim and no other privileges, can invoke arbitrary operations on the service as the victim principal for the lifetime of the captured signing key. There is no rate limit on replays. The DetectReplays setting on transport-security bindings does not mitigate the issue because the attack does not reuse the original timestamp — the fresh timestamp in the wsse:Security header is what the replay-detection logic inspects. ### Patches Fixed in CoreWCF v1.8.1 and v1.9.1 ### Workarounds Ensure communication is protected by SSL/TLS to prevent capturing of signed SOAP envelope.
Update CoreWCF.Primitives to 1.8.1; CoreWCF.Primitives to 1.9.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanCoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages affects CoreWCF.Primitives (nuget), CoreWCF.Primitives (nuget). Severity is high. ### Impact The attacker, with one captured signed SOAP envelope from a victim and no other privileges, can invoke arbitrary operations on the service as the victim principal for the lifetime of the captured signing key. There is no rate limit on replays. The DetectReplays setting on transport-security bindings does not mitigate the issue because the attack does not reuse the original timestamp — the fresh timestamp in the wsse:Security header is what the replay-detection logic inspects. ### Patches Fixed in CoreWCF v1.8.1 and v1.9.1 ### Workarounds Ensure communication is protected by SSL/TLS to prevent capturing of signed SOAP envelope.
AI coding agents often install or upgrade packages automatically in nuget. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| CoreWCF.Primitivesnuget | <1.8.1 | 1.8.1 |
| CoreWCF.Primitivesnuget | >=1.9.0,<1.9.1 | 1.9.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate CoreWCF.Primitives to 1.8.1; CoreWCF.Primitives to 1.9.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanCoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages affects CoreWCF.Primitives (nuget), CoreWCF.Primitives (nuget). Severity is high. ### Impact The attacker, with one captured signed SOAP envelope from a victim and no other privileges, can invoke arbitrary operations on the service as the victim principal for the lifetime of the captured signing key. There is no rate limit on replays. The DetectReplays setting on transport-security bindings does not mitigate the issue because the attack does not reuse the original timestamp — the fresh timestamp in the wsse:Security header is what the replay-detection logic inspects. ### Patches Fixed in CoreWCF v1.8.1 and v1.9.1 ### Workarounds Ensure communication is protected by SSL/TLS to prevent capturing of signed SOAP envelope.
AI coding agents often install or upgrade packages automatically in nuget. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| CoreWCF.Primitivesnuget | <1.8.1 | 1.8.1 |
| CoreWCF.Primitivesnuget | >=1.9.0,<1.9.1 | 1.9.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard