CVE-2024-29059: .NET Framework Information Disclosure

CVE-2024-29059 Overview

CVE-2024-29059 is an information disclosure vulnerability affecting Microsoft .NET Framework. This vulnerability allows remote attackers to obtain sensitive information from affected systems through error messages that expose implementation details. The flaw exists due to improper handling of error generation, enabling attackers to extract sensitive data without requiring authentication or user interaction.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations should prioritize immediate patching due to the network-accessible attack vector and high confidentiality impact.

Affected Products

• Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.6, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and 4.8.1
• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
• Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

• 2024-03-23 - CVE-2024-29059 published to NVD
• 2025-10-28 - Last updated in NVD database

Technical Details for CVE-2024-29059

Vulnerability Analysis

This vulnerability is classified under CWE-209 (Generation of Error Message Containing Sensitive Information). The .NET Framework improperly handles error generation, causing detailed internal information to be exposed through error messages. When certain operations fail, the framework generates error responses that contain sensitive implementation details, file paths, configuration information, or internal state data that should not be accessible to remote users.

The vulnerability can be exploited remotely over the network without requiring any privileges or user interaction. While the vulnerability does not allow attackers to modify data or disrupt services, the confidentiality impact is considered high as attackers can obtain sensitive information that may facilitate further attacks against the affected system or organization.

Root Cause

The root cause of CVE-2024-29059 lies in the .NET Framework's error handling mechanism, specifically related to CWE-209 (Generation of Error Message Containing Sensitive Information). When the framework encounters certain error conditions, it generates verbose error messages that inadvertently include sensitive internal details. This occurs because the error generation routines do not properly sanitize or filter the information before including it in error responses that may be returned to remote clients.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. An attacker can craft specific requests to trigger error conditions in vulnerable .NET Framework applications. The resulting error messages may contain sensitive information such as internal file paths, configuration details, memory addresses, or other implementation-specific data that can be leveraged for reconnaissance or to facilitate subsequent attacks.

The vulnerability exploitation flow involves:

1. Attacker identifies a target system running a vulnerable version of .NET Framework
2. Attacker sends crafted requests designed to trigger error conditions
3. The vulnerable application generates detailed error messages
4. Attacker extracts sensitive information from the error responses
5. Extracted information is used for further exploitation or reconnaissance

Detection Methods for CVE-2024-29059

Indicators of Compromise

• Unusual patterns of error responses being returned to external IP addresses
• Repeated requests from the same source triggering application errors
• Log entries showing verbose error messages being generated in response to external requests
• Network traffic analysis revealing detailed error information being transmitted externally

Detection Strategies

• Monitor web application and IIS logs for patterns of requests that consistently generate error responses
• Implement network-level monitoring to detect sensitive information in outbound traffic
• Deploy intrusion detection signatures that identify information disclosure patterns in HTTP responses
• Conduct regular vulnerability scanning to identify unpatched .NET Framework installations

Monitoring Recommendations

• Enable detailed logging for .NET Framework applications to track error generation
• Configure SIEM rules to alert on anomalous error response patterns
• Monitor for reconnaissance activity that may precede exploitation attempts
• Track patch status across all systems running affected .NET Framework versions

How to Mitigate CVE-2024-29059

Immediate Actions Required

• Apply Microsoft security updates immediately given this vulnerability is actively exploited
• Inventory all systems running .NET Framework to identify affected installations
• Prioritize patching for internet-facing systems and applications
• Review application configurations to minimize verbose error output to external users

Patch Information

Microsoft has released security updates to address this vulnerability. Patches are available through Windows Update and the Microsoft Update Catalog. Organizations should refer to the Microsoft Security Update Guide for CVE-2024-29059 for detailed patching instructions and download links specific to their affected .NET Framework versions and Windows operating systems.

Given that this vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog, federal agencies and organizations following CISA guidance should apply patches according to the specified remediation deadline.

Workarounds

• Configure custom error pages in ASP.NET applications to prevent detailed error information from being displayed to remote users by setting <customErrors mode="On"> in web.config
• Implement a Web Application Firewall (WAF) to filter responses containing sensitive error information
• Apply network segmentation to limit exposure of vulnerable systems to untrusted networks
• Review and harden error handling code in custom .NET applications to prevent information leakage

# Example web.config configuration to suppress detailed errors
# Add the following to prevent verbose error messages:
# <configuration>
#   <system.web>
#     <customErrors mode="On" defaultRedirect="~/Error.aspx">
#       <error statusCode="500" redirect="~/ServerError.aspx"/>
#     </customErrors>
#   </system.web>
# </configuration>