Local privilege escalation in IIS-hosted applications

Elevation of privilege in Microsoft ASP.NET Core and Visual Studio allows local users to gain higher privileges when applications run under IIS. Microsoft identifies ASP.NET Core Module as the affected component but has not published the flawed operation or attacker-controlled input responsible for the privilege boundary failure. Exploitation requires local low-privileged access and an ASP.NET Core application hosted within IIS; the published consequence is elevation to higher privileges.