.NET and Visual Studio Denial of Service Vulnerability

Vulnerability

Details CVE-2024-38168 is a denial of service vulnerability in .NET and Visual Studio, specifically affecting ASP.NET Core applications running on the Windows HTTP.sys web server. The vulnerability exists in the way HTTP.sys handles certain unauthenticated requests, leading to resource exhaustion or crash. This issue is limited to Windows operating systems and does not affect cross-platform deployments [1].

Exploitation

An attacker can exploit this vulnerability by sending specially crafted, unauthenticated HTTP requests to an affected ASP.NET Core application. No authentication or prior access is required; the attack can be performed remotely over the network. The vulnerability is triggered at the HTTP.sys level, making it accessible to any client that can reach the server [1].

Impact

Successful exploitation results in a denial of service condition, causing the web server to become unresponsive or crash. This can disrupt service availability for legitimate users. The vulnerability is rated with a CVSS score (not provided in references but typical for DoS) and has no identified mitigating factors [1].

Mitigation

Microsoft has released patches for .NET 8.0 (version 8.0.8) that address this vulnerability. Affected packages include Microsoft.AspNetCore.App.Runtime.win-* versions prior to 8.0.8. Developers should update their .NET SDK or runtime to the latest version. Visual Studio users will be prompted to update. No workarounds are available [1].