CVE-2019-0564

Vulnerability

A denial of service vulnerability exists in ASP.NET Core when it improperly handles specially crafted web requests [3]. The flaw affects ASP.NET Core 2.1 and 2.2, specifically in the packages Microsoft.AspNetCore.WebSockets, Microsoft.AspNetCore.Server.Kestrel.Core, System.Net.WebSockets.WebSocketProtocol, Microsoft.NETCore.App, Microsoft.AspNetCore.App, and Microsoft.AspNetCore.All [3]. The vulnerable versions are listed in the Microsoft advisory [3]; for example, Microsoft.AspNetCore.WebSockets versions 2.2.0, 2.1.0, and 2.1.1 are vulnerable.

Exploitation

A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted requests to an affected ASP.NET Core application [3]. No special privileges or user interaction is required.

Impact

Successful exploitation causes a denial of service condition, making the ASP.NET Core web application unavailable [3]. The attacker does not gain any other access or control; the impact is limited to availability.

Mitigation

Microsoft has released updates to address the vulnerability [3]. The secure versions are: Microsoft.AspNetCore.WebSockets (2.2.1 or 2.1.7), Microsoft.AspNetCore.Server.Kestrel.Core (2.1.7), System.Net.WebSockets.WebSocketProtocol (4.5.3), Microsoft.NETCore.App (2.2.1 or 2.1.7), Microsoft.AspNetCore.App (2.2.1 or 2.1.7), and Microsoft.AspNetCore.All (2.2.1 or 2.1.7) [3]. No workarounds or mitigating factors have been identified [3]. Users should update their applications to the latest patched versions.