Collected research

Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework

Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework (CVE-2023-36899 & CVE-2023-36560)

Soroush Dalili · soroush.me

Repeating the ASP.NET cookieless session token inside a URL path, or appending it after the file extension as PathInfo, makes the framework strip path segments after IIS has already applied its rules. That reaches directories IIS protects with authentication or blocks outright, and runs a page under its parent application pool, which is a privilege escalation.

Record

Document

Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework (CVE-2023-36899 & CVE-2023-36560)

Researcher

Soroush Dalili

Published by

soroush.me

Topic

Identity

In the archive

• Collected in the 2023 research round

Tags

• auth-bypass
• privilege-escalation
• path-traversal
• url-parsing
• aspnet
• dotnet
• waf-bypass
• cve
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Soroush Dalili, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.