Is CVE-2023-38180 exploited in the wild?

Yes. CVE-2023-38180 is known to be exploited in the wild, first recorded on 9 August 2023. Treat it as urgent.

How severe is CVE-2023-38180?

Critical severity, with a CVSS score of 3.1, published 9 August 2023.

Which products and versions are affected?

Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) ECOSYSTEM:introduced=7.0.0,fixed=7.0.10; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) ECOSYSTEM:introduced=7.0.0,fixed=7.0.10; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) ECOSYSTEM:introduced=7.0.0,fixed=7.0.10; Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv (NuGet) ECOSYSTEM:introduced=6.0.0,fixed=6.0.21; and 1 more.

Is there a fix for CVE-2023-38180?

Yes. Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 7.0.10 or later; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 7.0.10 or later; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 7.0.10 or later; Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv (NuGet): upgrade to 6.0.21 or later; Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets (NuGet): upgrade to 2.1.40 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-38180 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-38180?

Check whether you run Microsoft .NET Core, Microsoft Visual Studio, Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-38180: .NET Denial of Service Vulnerability

CVE-2023-38180 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2023-08-09

Microsoft .NET, ASP.NET, and Visual Studio are vulnerable to a denial-of-service attack due to uncontrolled resource consumption. The vulnerability allows an unauthenticated remote attacker to cause a DoS condition via the network.

Technologies: Microsoft .NET Core, Microsoft Visual Studio, Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet), Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet), Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2023-38180 exploited in the wild?: Yes. CVE-2023-38180 is known to be exploited in the wild, first recorded on 9 August 2023. Treat it as urgent.
How severe is CVE-2023-38180?: Critical severity, with a CVSS score of 3.1, published 9 August 2023.
Which products and versions are affected?: Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) ECOSYSTEM:introduced=7.0.0,fixed=7.0.10; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) ECOSYSTEM:introduced=7.0.0,fixed=7.0.10; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) ECOSYSTEM:introduced=7.0.0,fixed=7.0.10; Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv (NuGet) ECOSYSTEM:introduced=6.0.0,fixed=6.0.21; and 1 more.
Is there a fix for CVE-2023-38180?: Yes. Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 7.0.10 or later; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 7.0.10 or later; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 7.0.10 or later; Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv (NuGet): upgrade to 6.0.21 or later; Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets (NuGet): upgrade to 2.1.40 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-38180 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-38180?: Check whether you run Microsoft .NET Core, Microsoft Visual Studio, Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 7.0.10 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm64 --version 7.0.10

Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 7.0.10 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-x64 --version 7.0.10

Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 7.0.10 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-x86 --version 7.0.10

Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv (NuGet): upgrade to 6.0.21 or later

dotnet add package Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv --version 6.0.21

Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets (NuGet): upgrade to 2.1.40 or later

dotnet add package Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets --version 2.1.40

Affected products

Microsoft .NET 6.0.0 to 6.0.21, 7.0.0 to 7.0.10
Microsoft ASP.NET Core 2.1 to 2.1.40
Microsoft Visual Studio 2022 17.2.0 to 17.2.18, 17.4.0 to 17.4.10, 17.6.0 to 17.6.6

Identifiers

CVE-2023-38180
GHSA-vmch-3w2x-vhgq

Timeline

2023-08-09: disclosed
2023-08-09: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2023-08-09: patched: Microsoft released patches for affected products.
exploited: Reported as exploited in the wild.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.