cbcvebase.
CVE-2011-1271
published 2011-05-10

CVE-2011-1271: The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handle expressions…

PriorityP261high7.7CVSS 3.1
AVNACHPRNUINSUCHIHAL
EXPLOIT
EPSS
20.10%
97.2th percentile
The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handle expressions related to null strings, which allows context-dependent attackers to bypass intended access restrictions, and consequently execute arbitrary code, in opportunistic circumstances by leveraging a crafted application, as demonstrated by (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework JIT Optimization Vulnerability."

Affected

4 ranges
VendorProductVersion rangeFixed in
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——

Detection & IOCsextracted from sources · hover to see the quote

commandif ((value == null || value == new string[0]) == false)↗
  • →Look for crafted XAML browser applications (XBAP) being loaded in the browser context, which may be leveraging the JIT null-string optimization bypass. ↗
  • →Monitor for crafted ASP.NET applications that may exploit the JIT optimizer's improper handling of null string expressions. ↗
  • →The vulnerability is only exploitable when IsJITOptimizerDisabled is false (default state); flag environments where JIT optimization is enabled and untrusted .NET code executes. ↗
  • →Exploitation is specific to x86 architectures running the .NET JIT compiler; scope detection efforts to x86 process instances of .NET runtimes. ↗
  • ·The vulnerability only triggers when the JIT optimizer is enabled (IsJITOptimizerDisabled = false), which is the default. Environments that have explicitly disabled JIT optimization are not affected. ↗
  • ·Exploitation is described as opportunistic — an attacker must leverage a crafted application already present or deliverable in the target environment; there is no standalone remote vector without a crafted payload. ↗

CVSS provenance

nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.