CVE-2024-48924

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. HeroDevs NES Essentials Plus maintains a MessagePack-CSharp fork for post-EOL .NET environments that need backported security fixes while staying on the NES package line.

A Denial of Service (DoS) vulnerability (CVE-2024-48924) has been identified in MessagePack-CSharp, which allows a remote attacker who can supply untrusted MessagePack data to force excessive CPU consumption through crafted hash collisions during deserialization. When the library deserializes a map, it builds an internal hash-based lookup keyed on the incoming keys using a fast but non-collision-resistant hash, so an attacker can craft a payload whose keys all collide and degrade that lookup to worst-case behavior, disproportionate to the size of the input.

Per CWE-328: Use of Weak Hash, Use of Weak Hash is defined as a product using an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

This issue affects MessagePack-CSharp v2 releases before 2.5.187 and v3 prereleases from 2.6.95-alpha before 3.0.214-rc.1. The upstream fix is already present in the NES Essentials Plus MessagePack 2.5.192.x fork base.

‍

Details

Module Info

• Product: MessagePack-CSharp
• Affected packages: MessagePack
• Affected versions:
  
  • MessagePack < 2.5.187
  • MessagePack >= 2.6.95-alpha < 3.0.214-rc.1
• GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
• Published packages: https://www.nuget.org/packages/MessagePack
• Package manager: NuGet
• Fixed in: NES Essentials Plus MessagePack 2.5.192.x (the fork base already carries the upstream 2.5.187 / 3.0.214-rc.1 fix)

Vulnerability Info

This High-severity vulnerability is found in the MessagePack package used across .NET applications, including the SignalR MessagePack hub protocol in ASP.NET Core. When MessagePack-CSharp deserializes a map into a dictionary or an object, it builds an internal hash-based lookup keyed on the incoming keys. The library used a fast but non-collision-resistant hash to populate that lookup, so an attacker who controls the serialized data can craft many keys that hash to the same bucket. The resulting hash collisions degrade lookups to worst-case behavior, consuming CPU far out of proportion to the size of the payload and stalling the process that performs the deserialization. Because the SignalR MessagePack hub protocol deserializes attacker-supplied frames, a remote client can trigger this against a server without authentication beyond whatever the hub endpoint itself requires. Collision-resistant hashing is available through MessagePackSecurity.GetHashCollisionResistantEqualityComparer, which patched releases use for untrusted data by adopting the SipHash keyed hash function.

This vulnerability has been present since at least MessagePack-CSharp 2.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • MessagePack >= 2.5.187
  • MessagePack >= 3.0.214-rc.1
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES Essentials Plus MessagePack 2.5.192.x or later.

‍

Credits

• Andrew Arnott from the MessagePack-CSharp project (remediation developer)
• neuecc and GrabYourPitchforks (remediation reviewers)