Junglewise Threat Intelligence

CVE-2022-38013: Microsoft .NET stack overflow in ASP.NET Core model binding

CVE-2022-38013 · Severity: high · CVSS 7.5 · Published 2022-09-15

Technologies: Microsoft Asp.Net Core, Microsoft .NET Core. Vendors: Microsoft.

Executive brief

A vulnerability in Microsoft .NET and ASP.NET Core could allow an attacker to crash web applications remotely. By sending a specially crafted request, an attacker can trigger a system failure that makes the application unavailable to legitimate users. This affects various versions of the .NET runtime used to build and run modern Windows and Linux applications.

Technical details

A denial of service (DoS) vulnerability exists in ASP.NET Core and .NET due to improper handling of deeply nested or complex payloads during the model binding process. An unauthenticated remote attacker can exploit this by sending a customized payload that, when parsed, triggers a stack overflow. This results in the immediate termination of the affected process. The vulnerability specifically impacts the model binding component in ASP.NET Core 3.1 and .NET 6.0. Microsoft has released patches (3.1.29 and 6.0.9) to address this issue by improving resource management during parsing.

Affected products

  • Microsoft .NET Core 3.1.0 to 3.1.28
  • Microsoft .NET 5.0.0 to 6.0.8
  • Microsoft ASP.NET Core 3.1.0 to 3.1.28, 5.0.0 to 6.0.8

Timeline

  • 2022-09-13: advisory: Initial Microsoft MSRC advisory published
  • 2022-09-15: disclosed: GitHub Advisory published

References

Related threats