CVE-2024-38167: Microsoft .NET Information Disclosure Flaw

CVE-2024-38167 Overview

CVE-2024-38167 is an information disclosure vulnerability affecting Microsoft .NET and Visual Studio 2022. The flaw is categorized under [CWE-319] Cleartext Transmission of Sensitive Information. A remote attacker can obtain confidential data from an affected system when a user is tricked into performing a specific action, since the attack requires user interaction over the network. Microsoft published the advisory on August 13, 2024.

Critical Impact
An unauthenticated network attacker can disclose sensitive information from vulnerable .NET and Visual Studio 2022 installations when a user interacts with attacker-controlled content.

Affected Products

Microsoft .NET
Microsoft Visual Studio 2022
Applications built on affected .NET runtime versions

Discovery Timeline

2024-08-13 - CVE-2024-38167 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38167

Vulnerability Analysis

CVE-2024-38167 is an information disclosure weakness in the .NET runtime and Visual Studio 2022. The underlying weakness is classified as cleartext transmission of sensitive information [CWE-319]. When an application built on the affected runtime processes attacker-influenced content, sensitive data can be exposed to a network-positioned adversary.

Exploitation requires user interaction, meaning the target must open a crafted file, visit a malicious endpoint, or trigger the vulnerable code path in a client application. No prior authentication is needed against the vulnerable component. Confidentiality is impacted, while integrity and availability of the host remain intact.

Root Cause

The root cause is improper protection of data in transit within affected .NET components. Sensitive values traverse a channel without adequate confidentiality controls, allowing an attacker who can observe or influence the exchange to recover the data. Microsoft has not published low-level technical details beyond the advisory.

Attack Vector

The attack vector is network-based with low complexity. An attacker delivers crafted content, typically through a malicious URL, project file, or dependency, that the target processes with a vulnerable .NET or Visual Studio 2022 instance. Successful exploitation yields information disclosure without executing arbitrary code on the endpoint.

No public proof-of-concept exists, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update Guide for authoritative product and build details.

Detection Methods for CVE-2024-38167

Indicators of Compromise

Unexpected outbound connections from devenv.exe, dotnet.exe, or msbuild.exe to unfamiliar hosts
.NET or Visual Studio 2022 processes loading project files or NuGet packages from untrusted origins
Cleartext transmissions from developer endpoints containing tokens, credentials, or source metadata

Detection Strategies

Inventory .NET runtime and SDK versions against Microsoft's fixed build list in the advisory
Inspect network telemetry for developer workstations sending sensitive data over unencrypted channels
Correlate opening of untrusted .sln, .csproj, or .nupkg artifacts with subsequent anomalous network activity

Monitoring Recommendations

Enable process and network telemetry on developer endpoints running Visual Studio 2022
Alert on Visual Studio or dotnet child processes initiating connections outside of approved package feeds
Track patch compliance for .NET 6.0, 7.0, and 8.0 runtimes across build agents and workstations

How to Mitigate CVE-2024-38167

Immediate Actions Required

Apply the August 2024 Microsoft security updates for .NET and Visual Studio 2022 on all affected systems
Update CI/CD build agents and container images that ship the affected .NET runtime versions
Restrict developer interaction with untrusted solution files, project files, and third-party packages

Patch Information

Microsoft has released fixed builds for affected .NET runtimes and Visual Studio 2022. Consult the Microsoft Security Update Guide for the specific build numbers that remediate CVE-2024-38167 and deploy them through Windows Update, the Visual Studio Installer, or your standard patch management workflow.

Workarounds

Avoid opening untrusted .NET projects, solutions, or packages until patches are applied
Enforce TLS and package source verification for internal and external NuGet feeds
Segment developer networks to limit exposure of sensitive artifacts to untrusted endpoints

bash

# Verify installed .NET runtime versions after patching
dotnet --list-runtimes
dotnet --list-sdks

# Update Visual Studio 2022 from an elevated prompt
"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vs_installer.exe" update ^
  --productId Microsoft.VisualStudio.Product.Enterprise ^
  --channelId VisualStudio.17.Release --passive --norestart