CVE-2018-8269

Vulnerability

A denial of service vulnerability exists in the OData library (Microsoft.Data.OData) used by ASP.NET Core, which improperly handles crafted web requests. The vulnerability affects all versions of Microsoft.Data.OData prior to 5.8.4. Additionally, ASP.NET Core packages that depend on the OData library, such as Microsoft.AspNetCore.DataProtection.AzureStorage versions 2.1.1 and 2.2.0, and the Microsoft.AspNetCore.All shared framework versions 2.1.0–2.1.12 and 2.2.0–2.2.6, are affected [2]. The issue also impacts Microsoft SharePoint Server 2016 due to its dependency on the same OData library [3].

Exploitation

A remote unauthenticated attacker can exploit the vulnerability by sending specially crafted HTTP requests that include malicious OData filters to an application that uses the vulnerable OData library. For SharePoint Server 2016, sending more than ten such requests within a five-minute interval will exceed the default process recovery limit, causing the server to become unavailable until manually restarted [2][3]. No authentication or prior access is required.

Impact

Successful exploitation results in a denial of service condition, rendering the targeted OData web application or SharePoint server non-functional. The attacker causes the server process to terminate, and once the recovery limit is exhausted, the service remains down until an administrator manually restarts it. This impacts availability of the affected service [1][2][3].

Mitigation

Update the Microsoft.Data.OData package to version 5.8.4 or later. For ASP.NET Core applications using the Microsoft.AspNetCore.DataProtection.AzureStorage package, upgrade to version 2.1.2 or 2.2.1. For applications using the Microsoft.AspNetCore.All shared framework, upgrade to version 2.1.13 or 2.2.7. These updates were released by Microsoft on September 13, 2018 [2].