---

Introduction

In June 2024, Microsoft published details of a new vulnerability tracked as CVE-2024-38095, affecting both .NET and Visual Studio. This flaw doesn’t allow for remote code execution or privilege escalation, but it does enable an attacker to cause a Denial of Service (DoS)—making .NET applications or Visual Studio itself crash or become unresponsive.

This post will walk you through everything important about this vulnerability: what it is, how it works, exploitation details, sample code, and how you can protect yourself.

Type: Denial of Service (DoS)

- Affected Software: .NET SDK, .NET runtimes, and some Visual Studio versions that use vulnerable .NET libraries.

Severity: Medium (Denial of service, no remote code execution)

- Description: Attackers can craft specific inputs, data, or source files that, when parsed or built using .NET or Visual Studio, cause the process to stop responding or crash.

Official Microsoft Advisory:
Microsoft Security Update Guide for CVE-2024-38095

2. How Does CVE-2024-38095 Work?

Microsoft did not publish the full technical details, but based on patch diffs and community reverse engineering, CVE-2024-38095 appears to be an input validation bug in the handling of specific project, resources, or solution files.

Hang (application stops responding)

This could be triggered by opening a project in Visual Studio or running a vulnerable .NET application that parses external files.

3. Example Exploit: Crashing a .NET Application

*Disclaimer: The following is for educational purposes only. Only test in your own safe environments!*

Suppose the bug is triggered by resource (.resx) files with malicious nested elements. Consider this C# code snippet that loads a .resx file:

using System;
using System.Resources;

class Program
{
    static void Main(string[] args)
    {
        // Example: attacker-supplied file
        string attackResx = "evil.resx";
        try
        {
            using (ResXResourceReader reader = new ResXResourceReader(attackResx))
            {
                foreach (System.Collections.DictionaryEntry entry in reader)
                {
                    Console.WriteLine($"{entry.Key}: {entry.Value}");
                }
            }
        }
        catch (Exception ex)
        {
            Console.WriteLine("Error: " + ex.Message);
        }
    }
}

Now, if evil.resx contains deeply nested elements or recursive references (crafted by the attacker), the vulnerable .NET resource reader may either recurse endlessly or run out of memory, crashing the app.

Example Malicious Resx

<root>
  <data name="A" xml:space="preserve">
    <value>
      <data name="B" xml:space="preserve">
        <value>
          <!-- ... tens of thousands deep ... -->
        </value>
      </data>
    </value>
  </data>
</root>

What Happens?

- ResXResourceReader recursively processes elements, leading to stack overflow or out-of-memory exceptions.

CI Pipeline: Pushing malicious files to a code repository, causing build server crashes.

- Project Sharing: Tricking a developer into opening a specially crafted solution or resource file.
- Web Services: APIs accepting XML or resource files as input can be targeted to take down the service.

Update .NET SDK and runtimes:

Download from dotnet.microsoft.com/download

Update Visual Studio:

Use "Check for Updates" in Visual Studio or download latest from visualstudio.microsoft.com

Practice File Validation:

Never process untrusted files (especially XML, resource, or solution files) without validation and sandboxing.

In your code, consider adding *limits* and catching dangerous exceptions

try
{
    // ... file parsing ...
}
catch (OutOfMemoryException)
{
    Console.WriteLine("File too large or too complex!");
}
catch (StackOverflowException)
{
    Console.WriteLine("File caused a stack overflow: possibly malicious.");
}

6. Further References

- Microsoft Security Guide
- .NET GitHub announcement
- CISA Known Exploited Vulnerabilities Catalog

Summary

CVE-2024-38095 shows how denial of service bugs—even without code execution—can be harmful to developers and organizations. It’s important to keep your development tools up to date, validate inputs, and be careful with files received from untrusted sources.

Timeline

Published on: 07/09/2024 17:15:46 UTC
Last modified on: 09/02/2024 16:19:17 UTC