CVE-2024-38168
Uncontrolled Resource Consumption (CWE-400)
Summary
A vulnerability exists in .NET when an attacker through unauthenticated requests may trigger a Denial of Service in ASP.NET HTTP.sys web server. This is a windows OS only vulnerability. The vulnerability is related to Uncontrolled Resource Consumption (CWE-400).
Impact
This vulnerability allows an attacker to cause a Denial of Service (DoS) attack on the ASP.NET HTTP.sys web server. The attack can be initiated remotely over the network without requiring any user interaction or special privileges. The impact is primarily on the availability of the system, with no direct effect on integrity or confidentiality. Given the CVSS base score of 7.5 (High), this vulnerability is considered severe and could significantly disrupt services running on affected systems.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
Patches are available. Microsoft has released updates to address this vulnerability. The vulnerability affects .NET 8.0 versions from 8.0.0 up to, but not including, 8.0.8. It also impacts Visual Studio 2022 versions 17.6.0 to 17.6.18, 17.8.0 to 17.8.13, and 17.10.0 to 17.10.6. Users should update to the latest versions that include the patch.
Mitigation
To mitigate this vulnerability: 1. Update affected .NET installations to version 8.0.8 or later. 2. Update Visual Studio 2022 to versions 17.6.18, 17.8.13, or 17.10.6 or later, depending on your current version. 3. If immediate patching is not possible, consider implementing network segmentation to limit exposure of the vulnerable systems. 4. Monitor for any suspicious network activity or unexplained service disruptions that could indicate exploitation attempts. 5. Ensure that only necessary ports and services are exposed, particularly for systems running ASP.NET applications. 6. Implement strong access controls and authentication mechanisms to reduce the risk of unauthorized access.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Timeline
RedHat CVE advisory released a security advisory (CVE-2024-38168).
A CVSS base score of 7.3 has been assigned.
Feedly found the first article mentioning CVE-2024-38168. See article
Feedly estimated the CVSS score as MEDIUM
NVD published the first details for CVE-2024-38168
A CVSS base score of 7.5 has been assigned.
EPSS Score was set to: 0.09% (Percentile: 39.6%)