CVE-2024-21312: Microsoft .NET Framework DOS Vulnerability

CVE-2024-21312 Overview

CVE-2024-21312 is a Denial of Service vulnerability affecting Microsoft .NET Framework across multiple versions and Windows operating systems. This vulnerability allows remote attackers to cause service disruption by sending specially crafted requests to applications built on the affected .NET Framework versions. The vulnerability stems from improper input validation (CWE-20), which can be exploited without authentication to render affected services unavailable.

Critical Impact

Remote attackers can exploit this vulnerability to cause denial of service conditions in .NET Framework applications, potentially disrupting critical business services and web applications without requiring user interaction or authentication.

Affected Products

• Microsoft .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and 4.8.1
• Microsoft Windows Server 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, and 2022
• Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2, 23H2)

Discovery Timeline

• January 9, 2024 - CVE-2024-21312 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-21312

Vulnerability Analysis

This vulnerability exists within the .NET Framework's input handling mechanisms. When processing certain types of input, the framework fails to properly validate incoming data, allowing an attacker to craft malicious requests that consume excessive resources or trigger unhandled exceptions. The attack can be executed remotely over the network without requiring any privileges or user interaction.

The vulnerability is particularly concerning for organizations running web applications, web services, or network-facing applications built on the affected .NET Framework versions. Successful exploitation results in the targeted application becoming unresponsive, potentially cascading to affect dependent services and business operations.

Root Cause

The root cause of CVE-2024-21312 is improper input validation (CWE-20) within the .NET Framework. The framework does not adequately validate or sanitize certain input parameters before processing them, allowing malformed or excessive data to trigger resource exhaustion or application crashes. This type of vulnerability typically occurs when boundary conditions are not properly enforced during input processing operations.

Attack Vector

The attack vector is network-based, meaning an attacker can remotely target vulnerable .NET Framework applications without requiring local access to the system. The exploitation does not require any privileges or user interaction, making it particularly dangerous for internet-facing applications. An attacker would send specially crafted network requests to a vulnerable application, causing it to enter an unrecoverable state or consume excessive system resources until the service becomes unavailable.

The vulnerability affects the availability of the system without impacting confidentiality or integrity of data. This means that while attackers cannot steal or modify data through this vulnerability, they can effectively shut down services that rely on the affected .NET Framework components.

Detection Methods for CVE-2024-21312

Indicators of Compromise

• Unexpected application crashes or service restarts in .NET Framework-based applications
• Unusual network traffic patterns with high volumes of malformed requests to .NET services
• Elevated resource consumption (CPU, memory) in w3wp.exe or other .NET application processes
• Event log entries indicating unhandled exceptions in .NET Framework components

Detection Strategies

• Monitor Windows Event Logs for .NET Runtime errors and application crash events
• Implement network traffic analysis to detect anomalous request patterns targeting .NET endpoints
• Configure application performance monitoring (APM) to alert on service degradation or unavailability
• Deploy intrusion detection systems (IDS) with rules for detecting DoS attack patterns against web applications

Monitoring Recommendations

• Enable detailed logging for .NET Framework applications to capture exception details
• Set up automated alerts for service availability monitoring on critical .NET-based applications
• Implement rate limiting and request throttling at the network perimeter to mitigate DoS attempts
• Review application pool health metrics in IIS for .NET web applications

How to Mitigate CVE-2024-21312

Immediate Actions Required

• Apply the security updates provided by Microsoft through Windows Update or WSUS immediately
• Prioritize patching for internet-facing .NET applications and services
• Implement network-level protections such as Web Application Firewalls (WAF) and rate limiting
• Review and update incident response plans for denial of service scenarios

Patch Information

Microsoft has released security updates to address this vulnerability. Organizations should apply the patches available through the Microsoft Security Response Center (MSRC) Update Guide. The updates are available for all affected .NET Framework versions and can be deployed via Windows Update, Windows Server Update Services (WSUS), or manual download from the Microsoft Update Catalog.

Additional advisory information is available from NetApp Security Advisory NTAP-20240208-0008 for environments using NetApp products with affected .NET Framework components.

Workarounds

• Implement network segmentation to limit exposure of vulnerable .NET applications to untrusted networks
• Deploy Web Application Firewalls (WAF) with rules to filter potentially malicious requests
• Configure connection limits and request timeouts to reduce the impact of DoS attacks
• Consider disabling or restricting access to non-essential .NET services until patches can be applied

# Example: Configure IIS request filtering to limit request sizes
# Run in PowerShell as Administrator
Import-Module WebAdministration

# Set maximum allowed content length (in bytes)
Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' `
    -filter "system.webServer/security/requestFiltering/requestLimits" `
    -name "maxAllowedContentLength" -value 30000000

# Set maximum URL length
Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' `
    -filter "system.webServer/security/requestFiltering/requestLimits" `
    -name "maxUrl" -value 4096

# Set maximum query string length
Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' `
    -filter "system.webServer/security/requestFiltering/requestLimits" `
    -name "maxQueryString" -value 2048