PT-2024-2375 · Microsoft · .Net Framework

Markus Wulftange · Published 2024-03-22 · Updated 2026-03-31 · CVE-2024-29059

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions prior to 4.8.4682.0/4.8.9206.0

Description The vulnerability is related to insufficient protection of service data when processing ObjRef objects, which may allow a remote attacker to gain unauthorized access to protected information. A successful exploit may allow an attacker to disclose sensitive information. The issue has been exploited in the wild and is tracked by CISA as a Known Exploited Vulnerability.

Recommendations Upgrade .NET ASAP to the latest version to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to HTTP .NET Remoting to minimize the risk of exploitation. Avoid using ObjRef objects in HTTP .NET Remoting until the issue is resolved.

Exploit

Fix

RCE

Generation of Error Message Containing Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-209

CWE-200

Related Identifiers

BDU:2024-02326

CVE-2024-29059

Affected Products

.Net Framework

References · 34

• 🔥 https://github.com/codewhitesec/HttpRemotingObjRefLeak · Exploit
• https://osv.dev/vulnerability/CVE-2024-29059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29059 · Security Note
• https://bdu.fstec.ru/vul/2024-02326 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29059 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29059 · Security Note
• https://twitter.com/EduardKovacs/status/1887093054999318699 · Twitter Post
• https://twitter.com/CVEnew/status/1771314559992705467 · Twitter Post
• https://twitter.com/oktsec/status/1772851548101509141 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-29059 · Note
• https://twitter.com/TuringCyberObs/status/1887443929768788109 · Twitter Post
• https://t.me/cvenotify/110054 · Telegram Post
• https://twitter.com/ptracesecurity/status/1773315388085850434 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1771407511360348238 · Twitter Post
• https://twitter.com/shockwave_sec/status/1773300200750117142 · Twitter Post