CWE-520 (.NET误配置：使用伪装) — Vulnerability Class 2

CWE-520 represents a critical configuration weakness in .NET applications where developers improperly enable impersonation, allowing the application to execute with the identity of the authenticated client rather than a restricted service account. This misconfiguration is typically exploited by attackers who, after gaining initial access or valid credentials, leverage the impersonation feature to bypass application-level access controls. By assuming the client’s identity, malicious actors can escalate privileges to access sensitive file systems, databases, or operating system resources that would otherwise remain protected. To mitigate this risk, developers must strictly disable impersonation in configuration files unless absolutely necessary for specific business logic. When required, they should implement granular least-privilege principles, ensuring the impersonated identity holds only the minimal permissions needed, thereby preventing unauthorized escalation and limiting the blast radius of potential security breaches.