CVE-2024-30105: Microsoft .NET DOS Vulnerability

CVE-2024-30105 Overview

CVE-2024-30105 is a Denial of Service (DoS) vulnerability affecting Microsoft .NET and Visual Studio 2022. This vulnerability allows remote attackers to cause resource exhaustion through specially crafted network requests, potentially rendering affected applications or services unavailable. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that improper handling of resource allocation can be exploited to disrupt service availability.

Critical Impact

Remote attackers can exploit this vulnerability over the network without authentication to cause denial of service conditions in .NET applications and Visual Studio 2022 environments, potentially disrupting development workflows and production services.

Affected Products

• Microsoft .NET
• Microsoft Visual Studio 2022
• Applications built on affected .NET versions

Discovery Timeline

• 2024-07-09 - CVE-2024-30105 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-30105

Vulnerability Analysis

This vulnerability exists within the .NET framework and Visual Studio 2022, where improper handling of certain inputs leads to uncontrolled resource consumption. The attack can be initiated remotely over the network without requiring any privileges or user interaction, making it particularly concerning for internet-facing .NET applications. The vulnerability exclusively impacts availability—confidentiality and integrity of data remain unaffected. When exploited, the vulnerability causes the target system to consume excessive resources, leading to service degradation or complete unavailability.

Root Cause

The root cause of CVE-2024-30105 is classified as CWE-400: Uncontrolled Resource Consumption. This occurs when the .NET runtime fails to properly limit or throttle resource usage during the processing of certain inputs. When an attacker supplies maliciously crafted data, the framework attempts to process it without adequate safeguards, resulting in excessive CPU, memory, or other system resource consumption that degrades or halts normal operations.

Attack Vector

The attack vector for CVE-2024-30105 is network-based, requiring no authentication and no user interaction. An attacker can remotely send specially crafted requests to a vulnerable .NET application or Visual Studio instance. The attack complexity is low, meaning no special conditions or preparation are needed beyond network access to the target. This makes the vulnerability particularly attractive for opportunistic attacks against publicly accessible .NET services.

The exploitation mechanism involves sending malformed or resource-intensive payloads that trigger the uncontrolled resource consumption behavior in the vulnerable component. For detailed technical information about the specific exploitation vectors, refer to the Microsoft Security Update Guide.

Detection Methods for CVE-2024-30105

Indicators of Compromise

• Unusual spikes in CPU or memory utilization on systems running .NET applications
• Application pool crashes or service restarts in IIS hosting .NET applications
• Elevated thread counts or handle counts in .NET processes
• Network traffic patterns showing repeated requests to specific .NET endpoints

Detection Strategies

• Monitor system resource utilization metrics for .NET application pools and services
• Implement application performance monitoring (APM) to detect anomalous processing times
• Configure alerting for unexpected service restarts or application crashes
• Use network intrusion detection systems to identify suspicious request patterns targeting .NET endpoints

Monitoring Recommendations

• Enable detailed logging for .NET applications to capture request patterns and resource usage
• Configure Windows Performance Monitor counters for .NET CLR memory and CPU metrics
• Implement rate limiting and request throttling at the application or load balancer level
• Deploy SentinelOne Singularity Platform for real-time behavioral analysis and threat detection

How to Mitigate CVE-2024-30105

Immediate Actions Required

• Apply Microsoft security updates for .NET and Visual Studio 2022 immediately
• Review and update all .NET applications to use patched framework versions
• Implement network-level protections such as rate limiting and Web Application Firewalls
• Audit internet-facing .NET applications for exposure to this vulnerability

Patch Information

Microsoft has released security updates to address this vulnerability. Organizations should consult the Microsoft Security Update Guide for specific patch versions and installation guidance. Ensure all affected .NET runtime versions and Visual Studio 2022 installations are updated to the latest patched versions.

Workarounds

• Implement request rate limiting at the reverse proxy or load balancer level to mitigate potential DoS attempts
• Configure application-level timeouts and resource limits to prevent runaway resource consumption
• Restrict network access to .NET applications where possible using firewall rules
• Monitor and alert on resource consumption thresholds to enable rapid incident response

# Example: Configure IIS application pool resource limits
# Set CPU limit and enable throttling for .NET application pools
%windir%\system32\inetsrv\appcmd.exe set apppool "YourAppPool" /cpu.limit:80 /cpu.action:Throttle

# Configure request filtering limits in IIS
%windir%\system32\inetsrv\appcmd.exe set config /section:requestFiltering /requestLimits.maxAllowedContentLength:30000000