To understand how this vulnerability works, you need to know
about cryptographic oracles. An oracle in the context of cryptography is a
system which provides hints as you ask it questions. In this case, there is a
vulnerability in ASP.NET which acts as a padding oracle. This allows an
attacker to send cipher text to the web server and learn if it was decrypted
properly by examining which error code was returned by the web server. By
making many such requests (and watching what errors are returned) the attacker can
learn enough to successfully decrypt the rest of the cipher text.