CVE-2024-21404: Microsoft ASP.NET Core DOS Vulnerability

CVE-2024-21404 Overview

CVE-2024-21404 is a Denial of Service vulnerability affecting Microsoft's .NET framework, specifically impacting ASP.NET Core and Visual Studio 2022. This vulnerability allows remote attackers to cause service disruption without requiring authentication or user interaction, potentially leading to significant availability impacts on affected applications and development environments.

Critical Impact

Remote attackers can exploit this vulnerability over the network to cause denial of service conditions in ASP.NET Core applications and Visual Studio 2022, disrupting business operations and development workflows without requiring any privileges.

Affected Products

• Microsoft ASP.NET Core
• Microsoft Visual Studio 2022
• Applications built on affected ASP.NET Core versions

Discovery Timeline

• February 13, 2024 - CVE-2024-21404 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-21404

Vulnerability Analysis

This vulnerability is classified under CWE-476 (NULL Pointer Dereference), indicating a flaw where the application attempts to dereference a pointer that is expected to be valid but is actually null. In the context of ASP.NET Core and Visual Studio 2022, this null pointer dereference condition can be triggered remotely, causing the application to crash or become unresponsive.

The vulnerability is exploitable over the network without requiring any privileges or user interaction, making it particularly concerning for publicly-accessible ASP.NET Core web applications. When successfully exploited, the vulnerability results in complete loss of availability for the targeted service, though it does not impact data confidentiality or integrity.

Root Cause

The root cause of CVE-2024-21404 is a NULL Pointer Dereference (CWE-476) within the .NET framework code. This occurs when specific input conditions cause the application to reference a memory location through a null pointer, leading to an unhandled exception that terminates the process or renders it unresponsive. The vulnerability exists in how certain operations handle edge cases or malformed data, failing to properly validate pointer references before dereferencing them.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. An attacker can remotely send specially crafted requests or data to an ASP.NET Core application or Visual Studio 2022 instance that triggers the null pointer dereference condition. The low attack complexity means that exploitation is straightforward once the vulnerable component is accessible.

The vulnerability can be triggered by sending malformed requests that cause the affected component to enter a code path where null pointer handling is insufficient, resulting in service disruption.

Detection Methods for CVE-2024-21404

Indicators of Compromise

• Unexpected application crashes or restarts in ASP.NET Core services
• Increased occurrence of unhandled exception errors in application logs
• Null reference exceptions appearing in .NET runtime logs
• Service unavailability patterns that coincide with specific network requests

Detection Strategies

• Monitor ASP.NET Core application pools for abnormal restart patterns
• Implement application performance monitoring (APM) to detect null reference exceptions
• Review Windows Event Logs for .NET Runtime errors indicating null pointer issues
• Deploy network traffic analysis to identify potential exploit attempts targeting .NET applications

Monitoring Recommendations

• Configure alerting on application pool recycling events in IIS
• Enable detailed error logging in ASP.NET Core applications to capture exception stack traces
• Implement health check endpoints with automated monitoring to detect service degradation
• Use SentinelOne's application monitoring capabilities to detect anomalous crash patterns

How to Mitigate CVE-2024-21404

Immediate Actions Required

• Inventory all systems running ASP.NET Core and Visual Studio 2022 to identify vulnerable installations
• Apply Microsoft's security updates as soon as possible
• Implement rate limiting and input validation at the network edge to reduce exploitation risk
• Consider temporarily restricting access to affected services from untrusted networks until patches are applied

Patch Information

Microsoft has released security updates to address CVE-2024-21404. Administrators should consult the Microsoft Security Update Guide for detailed patching instructions and affected version information. Updates are available through Windows Update, Microsoft Update Catalog, and Visual Studio's built-in update mechanism.

For ASP.NET Core applications, ensure that the runtime and SDK are updated to the latest patched versions. For Visual Studio 2022, apply the latest security updates through the Visual Studio Installer.

Workarounds

• Deploy web application firewalls (WAF) to filter potentially malicious requests
• Implement application-level request validation to reject malformed input before processing
• Consider using load balancers with health checks to automatically route traffic away from crashed instances
• Enable automatic restart policies for affected application pools to minimize downtime impact

# Check installed .NET SDK and runtime versions
dotnet --list-sdks
dotnet --list-runtimes

# Update .NET SDK to latest version
dotnet sdk check

# For Visual Studio 2022, run the installer to check for updates
# Start Visual Studio Installer and click "Update" if available