CVE-2024-21386: Microsoft ASP.NET Core DOS Vulnerability

CVE-2024-21386 Overview

CVE-2024-21386 is a .NET Denial of Service vulnerability affecting Microsoft ASP.NET Core and Visual Studio 2022. This vulnerability allows remote attackers to cause a denial of service condition through network-based attacks without requiring authentication or user interaction. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that the flaw involves improper limitation of resource allocation that can be exploited to exhaust system resources.

Critical Impact

Remote attackers can exploit this vulnerability to cause service disruption in ASP.NET Core applications, potentially affecting the availability of web applications and services built on the .NET platform without requiring any privileges or user interaction.

Affected Products

• Microsoft ASP.NET Core
• Microsoft Visual Studio 2022

Discovery Timeline

• 2024-02-13 - CVE-2024-21386 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21386

Vulnerability Analysis

This denial of service vulnerability exists within the .NET framework's handling of certain operations in ASP.NET Core applications. The root cause relates to uncontrolled resource consumption (CWE-400), where the application fails to properly limit the allocation or consumption of resources when processing specific types of requests or data.

The vulnerability can be exploited remotely over the network without requiring any privileges or user interaction, making it particularly dangerous for internet-facing ASP.NET Core applications. When exploited, the vulnerability impacts only the availability of the affected system—confidentiality and integrity remain unaffected.

Root Cause

The vulnerability stems from improper resource management within ASP.NET Core's request handling mechanisms. When processing certain malformed or specially crafted requests, the application may consume excessive system resources such as memory or CPU cycles without proper bounds checking. This uncontrolled resource consumption (CWE-400) allows attackers to exhaust available resources, leading to service degradation or complete unavailability.

Attack Vector

The attack can be launched remotely over the network by sending specially crafted requests to an ASP.NET Core application. The attack characteristics include:

• Network-based exploitation: Attackers can target vulnerable applications over the internet without requiring local access
• No authentication required: The vulnerability can be exploited without any credentials or prior authentication
• No user interaction needed: The attack can succeed without any action from legitimate users
• Low complexity: The attack does not require sophisticated techniques or special conditions

The exploitation mechanism involves sending requests that trigger the resource exhaustion condition, causing the application to become unresponsive or crash. Detailed technical information about the specific attack payload is available in the Microsoft Security Update Guide.

Detection Methods for CVE-2024-21386

Indicators of Compromise

• Sudden increase in memory consumption by ASP.NET Core application worker processes
• Abnormally high CPU utilization without corresponding legitimate traffic increases
• Application pool crashes or restarts in IIS hosting ASP.NET Core applications
• Timeout errors or HTTP 503 Service Unavailable responses from previously stable endpoints

Detection Strategies

• Monitor ASP.NET Core application resource consumption patterns and alert on anomalous spikes
• Implement request rate limiting and analyze traffic patterns for potential DoS attack signatures
• Deploy web application firewalls (WAF) configured to detect and block malformed requests
• Use SentinelOne's Singularity platform to monitor for process anomalies and resource exhaustion patterns

Monitoring Recommendations

• Configure Application Performance Monitoring (APM) tools to track resource utilization baselines for .NET applications
• Set up alerts for worker process memory consumption exceeding normal operational thresholds
• Monitor IIS and Kestrel web server logs for unusual request patterns or error spikes
• Enable detailed .NET runtime diagnostics to capture resource allocation events during suspected attacks

How to Mitigate CVE-2024-21386

Immediate Actions Required

• Apply the latest security updates from Microsoft for ASP.NET Core and Visual Studio 2022 immediately
• Review and update all .NET runtime versions to patched releases as specified in the Microsoft Security Update Guide
• Implement request rate limiting on exposed ASP.NET Core endpoints as a defense-in-depth measure
• Consider temporarily restricting access to critical applications until patches can be applied

Patch Information

Microsoft has released security updates to address this vulnerability. Administrators should obtain patches through the following channels:

• Microsoft Security Update Guide: The official patch information and download links are available at the Microsoft Security Update Guide for CVE-2024-21386
• Visual Studio Updates: Update Visual Studio 2022 to the latest version through the Visual Studio Installer
• NuGet Package Updates: Update ASP.NET Core NuGet packages to the latest patched versions in your projects
• .NET SDK Updates: Install the latest .NET SDK that includes the security fixes

Workarounds

• Implement rate limiting middleware in ASP.NET Core applications to restrict request frequency from individual sources
• Configure reverse proxy or load balancer timeouts to prevent long-running malicious requests from consuming resources
• Deploy behind a Web Application Firewall (WAF) with rules to filter potentially malicious traffic patterns
• Consider implementing request size limits and connection timeouts at the application and infrastructure levels

Consult the Microsoft Security Update Guide for official guidance on configuration changes and workarounds until patches can be applied.