CVE-2024-29059
published 2024-03-23CVE-2024-29059: .NET Framework Information Disclosure Vulnerability
PriorityP185high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2025-02-25
Exploited in the wild
EPSS
98.62%
99.9th percentile
.NET Framework Information Disclosure Vulnerability
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_net_framework_2.0_service_pack_2 | >= 2.0.0 < 3.0.50727.8976 | 3.0.50727.8976 |
| microsoft | microsoft_net_framework_3.0_service_pack_2 | >= 3.0.0 < 3.0.50727.8976 | 3.0.50727.8976 |
| microsoft | microsoft_net_framework_3.5 | >= 3.5.0 < 3.0.50727.8976 | 3.0.50727.8976 |
| microsoft | microsoft_net_framework_3.5.1 | >= 3.5.0 < 3.0.30729.8959 | 3.0.30729.8959 |
| microsoft | microsoft_net_framework_3.5_and_4.6_4.6.2 | >= 10.0.0 < 10.0.10240.20402 | 10.0.10240.20402 |
| microsoft | microsoft_net_framework_3.5_and_4.7.2 | >= 4.7.0 < 4.7.04081.03 | 4.7.04081.03 |
| microsoft | microsoft_net_framework_3.5_and_4.8 | >= 4.8.0 < 4.8.04690.02 | 4.8.04690.02 |
| microsoft | microsoft_net_framework_3.5_and_4.8.1 | >= 4.8.1 < 4.8.09214.01 | 4.8.09214.01 |
| microsoft | microsoft_net_framework_4.6.2 | >= 4.7.0 < 4.7.04081.03 | 4.7.04081.03 |
| microsoft | microsoft_net_framework_4.6.2_4.7_4.7.1_4.7.2 | >= 4.7.0 < 4.7.04081.03 | 4.7.04081.03 |
| microsoft | microsoft_net_framework_4.8 | >= 4.8.0 < 4.8.04690.02 | 4.8.04690.02 |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| msrc | microsoft_net_framework_2.0_service_pack_2 | — | — |
| msrc | microsoft_net_framework_3.0_service_pack_2 | — | — |
| msrc | microsoft_net_framework_3.5 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path/RemoteApplicationMetadata.rem?wsdl
other__RequestVerb: POST
snort
alert http any any -> $HOME_NET any (msg:"ET EXPLOIT .NET Remoting BinaryServerFormatterSink ObjRef Leak (CVE-2024-29059)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/RemoteApplicationMetadata.rem?wsdl"; fast_pattern; endswith; http.header; to_lowercase; content:"__requestverb|3a 20|post"; http.content_type; content:"application|2f|octet-stream"; reference:url,code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting/; reference:cve,2024-29059; classtype:web-application-attack; sid:2056205; rev:1; metadata:attack_target Server, tls_state TLSDecrypt, created_at 2024_09_26, cve CVE_2024_29059, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2024_09_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
- →Detect exploit attempts by matching HTTP GET requests to '/RemoteApplicationMetadata.rem?wsdl' combined with the custom header '__RequestVerb: POST' and Content-Type 'application/octet-stream' — this is the two-step ObjRef leak probe.
- →Look for the string 'ObjRef' in HTTP response bodies from .NET Remoting endpoints — its presence confirms the server leaked an internal object reference URI.
- →Use Shodan queries for 'Server: MS .NET Remoting' to identify exposed .NET Remoting endpoints that may be vulnerable.
- →The exploit leaks ObjRef URIs which can then be used to perform .NET Remoting attacks leading to RCE — treat any disclosed ObjRef URI as a high-severity indicator requiring immediate investigation. ↗
- ·The Emerging Threats Snort rule (sid:2056205) requires TLS decryption to be effective against HTTPS-protected .NET Remoting endpoints, as indicated by the 'tls_state TLSDecrypt' and 'deployment SSLDecrypt' metadata.
- ·Red Hat confirmed all its .NET packages (dotnet6.0, dotnet7.0, dotnet8.0 on RHEL 8/9/10) are NOT affected — detection and patching efforts should focus on Windows/.NET Framework environments, not Linux .NET Core deployments. ↗
- ·Microsoft initially declined to service this vulnerability after CODE WHITE's November 2023 disclosure, only issuing a CVE and advisory in March 2024 — environments patched only through December 2023 updates may still be vulnerable. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vulncheck7.5HIGH
cisa7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft .NET Framework Information Disclosure Vulnerability
cisa·2025-02-04·CVSS 7.5
CVE-2024-29059 [HIGH] CWE-209 Microsoft .NET Framework Information Disclosure Vulnerability
Vulnerability: Microsoft .NET Framework Information Disclosure Vulnerability
Affected: Microsoft .NET Framework
Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29059 ; https://nvd.nist.gov/vuln/detail/CVE-2024-29059
Remediation Due Date: 2025-02-25
Red Hat
dotnet: .NET Framework Information Disclosure Vulnerability
vendor_redhat·2024-03-23·CVSS 7.5
CVE-2024-29059 [HIGH] CWE-200 dotnet: .NET Framework Information Disclosure Vulnerability
dotnet: .NET Framework Information Disclosure Vulnerability
.NET Framework Information Disclosure Vulnerability
Package: rh-dotnet60-dotnet (.NET 6.0 on Red Hat Enterprise Linux) - Not affected
Package: dotnet8.0 (Red Hat Enterprise Linux 10) - Not affected
Package: dotnet6.0 (Red Hat Enterprise Linux 8) - Not affected
Package: dotnet7.0 (Red Hat Enterprise Linux 8) - Not affected
Package: dotnet8.0 (Red Hat Enterprise Linux 8) - Not affected
Package: dotnet6.0 (Red Hat Enterprise Linux 9) - Not affected
Package: dotnet7.0 (Red Hat Enterprise Linux 9) - Not affected
Package: dotnet8.0 (Red Hat Enterprise Linux 9) - Not affected
Microsoft
.NET Framework Information Disclosure Vulnerability
vendor_msrc·2024-03-12·CVSS 7.5
CVE-2024-29059 [HIGH] CWE-209 .NET Framework Information Disclosure Vulnerability
.NET Framework Information Disclosure Vulnerability
FAQ: **What type of information could be disclosed by this vulnerability? **
An attacker who successfully exploited this vulnerability could obtain the ObjRef URI which could lead to remote code execution.
.NET Framework: .NET Framework
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Information Disclosure
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;DOS:N/A
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5033910
Reference: https://support.microsoft.com/help/5033910
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5033916
Reference: https://support.microsoft.com/help/5034277
Reference: https://catalog.update.microsof
GHSA
GHSA-pg2q-wfgh-r323
ghsa_unreviewed·2024-03-23
CVE-2024-29059 [HIGH] CWE-209 GHSA-pg2q-wfgh-r323
.NET Framework Information Disclosure Vulnerability
VulnCheck
Microsoft .NET Framework Information Disclosure Vulnerability
vulncheck·2024·CVSS 7.5
CVE-2024-29059 [HIGH] CWE-209 Microsoft .NET Framework Information Disclosure Vulnerability
Microsoft .NET Framework Information Disclosure Vulnerability
Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.
Affected: Microsoft .NET Framework
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-27&host_type=src&vulnerability=cve-2024-29059; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-08&host_type=src&vulnerability=cve-2024-29059; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-11&host_type=src&vulnerability=cve-2
Suricata
ET EXPLOIT .NET Remoting BinaryServerFormatterSink ObjRef Leak (CVE-2024-29059)
suricata·2024-09-26·CVSS 7.5
CVE-2024-29059 [HIGH] ET EXPLOIT .NET Remoting BinaryServerFormatterSink ObjRef Leak (CVE-2024-29059)
ET EXPLOIT .NET Remoting BinaryServerFormatterSink ObjRef Leak (CVE-2024-29059)
Rule: alert http any any -> $HOME_NET any (msg:"ET EXPLOIT .NET Remoting BinaryServerFormatterSink ObjRef Leak (CVE-2024-29059)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/RemoteApplicationMetadata.rem?wsdl"; fast_pattern; endswith; http.header; to_lowercase; content:"__requestverb|3a 20|post"; http.content_type; content:"application|2f|octet-stream"; reference:url,code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting/; reference:cve,2024-29059; classtype:web-application-attack; sid:2056205; rev:1; metadata:attack_target Server, tls_state TLSDecrypt, created_at 2024_09_26, cve CVE_2024_29059, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confi
Suricata
ET EXPLOIT .NET Remoting SoapServerFormatterSink ObjRef Leak (CVE-2024-29059)
suricata·2024-09-26·CVSS 7.5
CVE-2024-29059 [HIGH] ET EXPLOIT .NET Remoting SoapServerFormatterSink ObjRef Leak (CVE-2024-29059)
ET EXPLOIT .NET Remoting SoapServerFormatterSink ObjRef Leak (CVE-2024-29059)
Rule: alert http any any -> $HOME_NET any (msg:"ET EXPLOIT .NET Remoting SoapServerFormatterSink ObjRef Leak (CVE-2024-29059)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/RemoteApplicationMetadata.rem?wsdl"; fast_pattern; endswith; http.header; to_lowercase; content:"__requestverb|3a 20|post"; http.content_type; content:"text|2f|xml"; reference:url,code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting/; reference:cve,2024-29059; classtype:web-application-attack; sid:2056204; rev:1; metadata:attack_target Server, tls_state TLSDecrypt, created_at 2024_09_26, cve CVE_2024_29059, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signatur
Nuclei
.NET Framework - Leaking ObjRefs via HTTP .NET Remoting
nuclei·CVSS 7.5
CVE-2024-29059 [HIGH] .NET Framework - Leaking ObjRefs via HTTP .NET Remoting
.NET Framework - Leaking ObjRefs via HTTP .NET Remoting
.NET Framework Information Disclosure Vulnerability
Template:
id: CVE-2024-29059
info:
name: .NET Framework - Leaking ObjRefs via HTTP .NET Remoting
author: iamnoooob,rootxharsh,DhiyaneshDk,pdresearch
severity: high
description: .NET Framework Information Disclosure Vulnerability
impact: |
Attackers can exploit leaked ObjRefs to access remote objects via .NET Remoting, potentially gaining unauthorized access to application data.
remediation: |
Apply security patches for .NET Framework addressing CVE-2024-29059.
reference:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29059
- https://code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting/
- https://github.com/codewhitesec/HttpRemotingObjRefLeak
- htt
HackerOne
[███] .NET Framework ObjRefs Disclosure (CVE-2024-29059)
hackerone·2026-01-12·CVSS 7.5
CVE-2024-29059 [HIGH] [███] .NET Framework ObjRefs Disclosure (CVE-2024-29059)
[███] .NET Framework ObjRefs Disclosure (CVE-2024-29059)
Microsoft .NET Framework could allow a remote attacker to obtain sensitive information. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain the ObjRef URI and possibly execute arbitrary code on the system.
## Evidences
```
GET /RemoteApplicationMetadata.rem?wsdl HTTP/1.1
Host: ████
Content-Type: text/xml
__RequestVerb: POST
```
██████████
█████████
## References
-
## Impact
CVE-2024-29059 in ASP.NET web applications that might unknowingly leak internal object URIs, which can be used to perform .NET Remoting attacks via HTTP, possibly allowing unauthenticated remote code execution.
## System Host(s)
█████
## Affected Product(s) and Version(s)
## CVE Numbers
CVE-2024-29059
## Step
Bleepingcomputer
CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks
blogs_bleepingcomputer·2025-02-05·CVSS 7.5
[HIGH] CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks
## CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks
## Bill Toulas
The US Cybersecurity & Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities catalog, urging federal agencies and large organizations to apply the available security updates as soon as possible.
Among them are flaws impacting Microsoft .NET Framework and Apache OFBiz (Open For Business), two widely used software applications.
Though the agency has marked those flaws as actively exploited in attacks, it has not provided specific details about the malicious activity, who is conducting it, and against whom.
The first flaw, tracked under CVE-2024-29059 , is a high severity (CVSS v3 score: 7.5) information disclosure bug in the .NET Framework discov
2024-03-23
Published
2025-02-04
Added to CISA KEV
Exploited in the wild