Vulnerability in Hangfire.Core (CVE-2021-41238)
Summary
Vulnerability in Hangfire.Core (CVE-2021-41238). Confidential information can be exposed externally. Exploitable via LocalRequestsOnlyAuthorizationFilter. Mitigation: upgrade to 1.7.26 or later.
Original description
The description as published by the source.
Hangfire is an open source system to perform background job processing in a .NET or .NET Core applications. No Windows Service or separate process required. Dashboard UI in Hangfire.Core uses authorization filters to protect it from showing sensitive data to unauthorized users. By default when no custom authorization filters specified, LocalRequestsOnlyAuthorizationFilter filter is being used to allow only local requests and prohibit all the remote requests to provide sensible, protected by default settings. However due to the recent changes, in version 1.7.25 no authorization filters are used by default, allowing remote requests to succeed. If you are using UseHangfireDashboard method with default DashboardOptions.Authorization property value, then your installation is impacted. If any other authorization filter is specified in the DashboardOptions.Authorization property, the you are not impacted. Patched versions (1.7.26) are available both on Nuget.org and as a tagged release on the github repo. Default authorization rules now prohibit remote requests by default again by including the LocalRequestsOnlyAuthorizationFilter filter to the default settings. Please upgrade to the newest version in order to mitigate the issue. For users who are unable to upgrade it is possible to mitigate the issue by using the LocalRequestsOnlyAuthorizationFilter explicitly when configuring the Dashboard UI.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2021-41238 has been found in Hangfire.Core.
Attackers can target a specific entry point like LocalRequestsOnlyAuthorizationFilter over the network to misuse the product.
Confidential information can be exposed externally.
What to do: upgrade Hangfire.Core to 1.7.26 or later.
If unsure, ask your IT team or search "Hangfire.Core CVE-2021-41238" on the vendor's site.
CVE-2021-41238 (Hangfire.Core) — CWE-862
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: LocalRequestsOnlyAuthorizationFilter / UseHangfireDashboard / DashboardOptions.Authorization
Patched: 1.7.26 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-862) exists in Hangfire.Core. Attackers reach the vulnerable code path via LocalRequestsOnlyAuthorizationFilter without authentication.
Check the vendor advisory for the affected versions of Hangfire.Core. Attack surface: LocalRequestsOnlyAuthorizationFilter / UseHangfireDashboard / DashboardOptions.Authorization.
Severity: ?. Confidential information can be exposed externally.
Update to 1.7.26.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'Hangfire.Core' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'Hangfire.Core' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
Hangfire.Coreを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade Hangfire.Core to 1.7.26ステージング環境で 1.7.26 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web nuget.org