Junglewise Threat Intelligence

CVE-2022-24464: Microsoft .NET denial of service in HTTP form parsing

CVE-2022-24464 · Severity: high · CVSS 7.5 · Published 2022-10-21

Technologies: Microsoft Visual Studio 2022, Microsoft .NET Core. Vendors: Microsoft.

Executive brief

A vulnerability in Microsoft .NET and Visual Studio could allow an attacker to cause a denial-of-service (DoS) condition. .NET is a widely used framework for building and running web and desktop applications. By sending specially crafted HTTP form requests, an attacker could crash or hang an application, potentially disrupting business operations and service availability for customers.

Technical details

A denial-of-service vulnerability exists in .NET 6.0, .NET 5.0, and .NET Core 3.1 due to improper handling of specific HTTP form requests. The root cause is related to uncontrolled resource consumption (CWE-400) during the parsing of these requests. A remote, unauthenticated attacker can exploit this by sending a malicious HTTP request to a vulnerable application, leading to a crash or exhaustion of resources. This affects applications built on the impacted .NET runtimes and developers using specific versions of Visual Studio. Microsoft has released patches in .NET 6.0.3, 5.0.15, and 3.1.23 to address the issue.

Affected products

  • Microsoft .NET 5.0.0 to 5.0.14, 6.0.0 to 6.0.2
  • Microsoft .NET Core 3.1.0 to 3.1.22
  • Microsoft Visual Studio 2019 16.0 to 16.11
  • Microsoft Visual Studio 2022 17.0 to 17.1

Timeline

  • 2022-03-08: advisory: Initial advisory published by Microsoft
  • 2022-03-08: patched: Fixed versions released (6.0.3, 5.0.15, 3.1.23)
  • 2022-10-21: disclosed: GitHub Advisory published

References

Related threats