CVE-2024-28252 CoreWCF NetFraming based services can leave connections open when they should be closed
Attackers can exhaust system resources by leaving NetFraming connections open, causing denial of service in CoreWCF services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28252?
CVE-2024-28252 is a high-severity denial of service vulnerability in CoreWCF, published on 15 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. If you have a NetFraming based CoreWCF service, extra system resources could be consumed by connections being left established instead of closing or aborting them. There are two scenarios when this can happen. When a client established a connection to the service and sends no data, the service will wait indefinitely for the client to initiate the NetFraming session handshake. Additionally, once a client has established a session, if the client doesn't send any requests for the period of time configured in the binding ReceiveTimeout, the connection is not properly closed as part of the session being aborted. The bindings affected by this behavior are NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding. Only NetTcpBinding has the ability to accept non local connections. The currently supported versions of CoreWCF are v1.4.x and v1.5.x. The fix can be found in v1.4.2 and v1.5.2 of the CoreWCF packages. Users are advised to upgrade. There are no workarounds for this issue.
Weakness: CWE-404
Which versions are affected by CVE-2024-28252?
4 open source packages ship an affected version, including CoreWCF.NetFramingBase. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
CoreWCF.NetFramingBase NuGet | From 1.4.0 | 1.4.2 |
CoreWCF.NetFramingBase NuGet | From 1.4.0 | 1.4.2 |
CoreWCF.NetFramingBase NuGet | From 1.5.0 | 1.5.2 |
CoreWCF.NetFramingBase NuGet | From 1.5.0 | 1.5.2 |
Products include Corewcf Corewcf.
How do I fix CVE-2024-28252?
Upgrade CoreWCF.NetFramingBase to a fixed version for your release line: 1.4.2 or 1.5.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-28252 being exploited?
There is no known exploitation of CVE-2024-28252 in the wild and no public exploit code.
Sources
Also known as GHSA-32jq-mv89-5rx7.