How severe is GHSA-vx2x-9cff-fhjw?

GHSA-vx2x-9cff-fhjw has a CVSS score of 6.3/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by GHSA-vx2x-9cff-fhjw?

GHSA-vx2x-9cff-fhjw affects the following packages: DSInternals.Common (NuGet). Ecosystems affected: NuGet.

How do I fix GHSA-vx2x-9cff-fhjw?

Update DSInternals.Common to 4.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vx2x-9cff-fhjw is resolved across your whole dependency graph.

How do I detect GHSA-vx2x-9cff-fhjw in my NuGet dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for DSInternals.Common, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-vx2x-9cff-fhjw if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-vx2x-9cff-fhjw?

O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-vx2x-9cff-fhjw can be triaged on real exposure rather than presence alone.

Is GHSA-vx2x-9cff-fhjw actively exploited in the wild?

No public exploit code has been indexed for GHSA-vx2x-9cff-fhjw yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-vx2x-9cff-fhjw published, and has it been updated?

GHSA-vx2x-9cff-fhjw was published on December 6, 2022 and was last updated on December 3, 2024. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

.NET

.NET NuGet

Not in CISA KEV

MEDIUM severity

GHSA-vx2x-9cff-fhjw — DSInternals.Common

MEDIUM

GHSA-vx2x-9cff-fhjw is a medium-severity (CVSS 6.3) vulnerability in DSInternals.Common. A fix is available for DSInternals.Common — see the affected versions and patch details below.

DSInternals Credential Roaming Elevation of Privilege Vulnerability

Published

Dec 6, 2022

Updated

Dec 3, 2024

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Dec 3, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

.NETDSInternals.Common

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.

Description

Impact

A vulnerability exists in the DSInternals.Common.Data.RoamedCredential.Save() method, which incorrectly parses the msPKIAccountCredentials LDAP attribute values. As a consequence, a malicious actor would be able to modify the file system of the computer where an application using this function is executed with administrative privileges.

A similar security issue used to be present in the Windows operating system, as DSInternals re-implements the Credential Roaming feature of Windows.

Exploitability

The vulnerability can be exploited under the following circumstances:

An attacker is able to modify the msPKIAccountCredentials attribute of a user account in Active Directory. This attribute is used by the Credential Roaming feature of Windows and each AD user can modify their own roamed credentials. AND
A 3rd party application uses the DSInternals.Common library to export roamed credentials from Active Directory to a file system. AND
The application has administrative privileges on the local system.

The probability of any 3rd-party product using the DSInternals.Common library being affected by this vulnerability is extremely low.

Patches

The issue had been fixed in DSInternals 4.8.

References

https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
.NETNuGet	`DSInternals.Common`	≥ 2.21&&< 4.8	4.8`dotnet add package DSInternals.Common --version 4.8`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for DSInternals.Common, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update DSInternals.Common to 4.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vx2x-9cff-fhjw is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-vx2x-9cff-fhjw can be triaged on real exposure rather than presence alone.

Tailored to GHSA-vx2x-9cff-fhjw. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Impact A vulnerability exists in the `DSInternals.Common.Data.RoamedCredential.Save()` method, which incorrectly parses the `msPKIAccountCredentials` LDAP attribute values. As a consequence, a malicious actor would be able to modify the file system of the computer where an application using this function is executed with administrative privileges. A [similar security issue](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30170) used to be present in the Windows operating system, as DSInternals re-implements the Credential Roaming feature of Windows. ### Exploitability Th

O3 Security · Impact-Aware SCA

Is GHSA-vx2x-9cff-fhjw in your dependencies?

O3 Security finds GHSA-vx2x-9cff-fhjw across NuGet dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works