3Zer0

A cross-site request forgery (CSRF) flaw in Blazor and SignalR allows an unauthorized attacker to elevate privileges over a network. By sending a cross-site request to the '/ blazor/refresh' endpoint, an attacker can bind a user's identity to an attacker's circuit, enabling them to act as a signed-in user.

Allocation of resources without limits or throttling allows an unauthorized attacker to cause a denial of service over a network. Specifically, Blazor static-SSR client validation retains attacker-controlled rendered field names in an unbounded singleton cache, which can lead to remote process memory exhaustion.