CVE-2024-43485

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2024-43485) has been identified in the System.Text.Json library, which allows a remote, unauthenticated attacker to mount an algorithmic complexity attack against applications that deserialize untrusted JSON into a model containing a JsonExtensionData property, exhausting server resources and rendering the application unresponsive. The affected library is distributed both in-box with the .NET runtime and as the out-of-band System.Text.Json NuGet package.

Per CWE-407: Inefficient Algorithmic Complexity, Inefficient Algorithmic Complexity is defined as an algorithm in a product having an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

This issue affects applications that reference System.Text.Json below 6.0.10, whether directly or transitively. The NES for .NET 6.0 line is based on Microsoft .NET 6.0.36, which already carries the in-box System.Text.Json fix Microsoft shipped in .NET 6.0.35, so the in-box copy in NES releases is not affected; exposure in NES environments arises from a package reference below 6.0.10. NES for .NET 6.0.42 advances the bundled System.Text.Json package reference to 6.0.11. Microsoft serviced its own supported releases in the October 8, 2024 security updates (.NET 6.0.35 and .NET 8.0.10 runtimes; System.Text.Json 6.0.10 and 8.0.5). Applications that use the JsonExtensionData feature are impacted; applications that do not use that feature are not affected.

‍

Details

Module Info

• Product:
  
  • Any .NET 6.0 application referencing System.Text.Json 6.0.9 or earlier, or running on Microsoft .NET 6.0.33 or earlier.
  • Any .NET 8.0 application running on .NET 8.0.8 or earlier, or referencing System.Text.Json 8.0.4 or earlier.
• Affected packages:
  
  • System.Text.Json
• Affected versions:
  
  • System.Text.Json:
    
    • System.Text.Json >= 6.0.0 < 6.0.10
    • System.Text.Json >= 8.0.0 < 8.0.5
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager:
  
  • NuGet
  • Windows Installer
  • Docker
• Fixed in: NES for .NET 6.0.42

Vulnerability Info

This High-severity vulnerability is found in the System.Text.Json package in the .NET 6.0 and .NET 8.0 lines. When an application deserializes JSON into a model that declares a property annotated with JsonExtensionData, typically a Dictionary<string, object> or Dictionary<string, JsonElement> that captures otherwise-unmatched members, the deserializer collects every unmatched JSON property into that dictionary. The routine that populates the extension-data dictionary exhibits inefficient worst-case algorithmic complexity, so an attacker who submits a specially crafted JSON document containing a large set of unmatched members can force disproportionate CPU and memory consumption while those members are accumulated. A single moderately sized request is therefore sufficient to make the affected application unresponsive, producing a Denial of Service. The attack requires no authentication beyond whatever the deserializing endpoint already exposes, and any endpoint that binds untrusted JSON to a model containing a JsonExtensionData property is reachable. Models that do not use the JsonExtensionData feature are not affected.

This vulnerability has been present since at least System.Text.Json 6.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • System.Text.Json >= 6.0.10   (6.x package line)
  • System.Text.Json >= 8.0.5    (8.x package line)
  • .NET Runtime >= 6.0.35
  • .NET Runtime >= 8.0.10

• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.42 or later.

‍

Credits

Microsoft did not publicly credit an individual finder for this vulnerability in its security advisory.