CVE-2017-8759
Microsoft .NET Framework Remote Code Execution Vulnerability
Description
CVE-2017-8759 is a high-severity remote code execution vulnerability in the Microsoft .NET Framework. The vulnerability allows an attacker to execute arbitrary code remotely by tricking a user into opening a malicious document or application that exploits improper code generation in the .NET Framework. Multiple versions of the .NET Framework are affected, including versions 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, and 4.7. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 93.95% (99.88th percentile), CVE-2017-8759 has a near-certain probability of exploitation and requires immediate attention.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | .net framework | 4.5.2; 3.5.1; 3.5; 2.0; 4.6.1; 4.6; 4.7; 4.6.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/100742(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1039324(Broken Link, Third Party Advisory, VDB Entry)
- https://github.com/GitHubAssessments/CVE_Assessments_01_2020(Third Party Advisory)
- https://github.com/bhdresh/CVE-2017-8759(Exploit, Third Party Advisory)
- https://github.com/nccgroup/CVE-2017-8759(Exploit, Third Party Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8759(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/42711/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8759(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection vulnerabilities occur when software constructs all or part of a code segment using externally-influenced input but does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code. In CVE-2017-8759, this weakness manifests in the .NET Framework's handling of untrusted input, where a specially-crafted SOAP WSDL definition can inject arbitrary code during the parsing process, leading to remote code execution when a user opens a malicious document.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2017-8759 carries a CVSS 3.1 score of 7.8 (HIGH), indicating a significant security threat. The attack vector is local, meaning an attacker must deliver a malicious document or application to the victim, and user interaction is required to open it. However, the attack complexity is low and no special privileges are needed. Confidentiality (High): Successful exploitation provides the attacker with complete access to sensitive data on the compromised system. Integrity (High): The attacker gains the ability to modify any data or install malicious software. Availability (High): Full disruption of system availability is possible. The scope is unchanged, meaning the impact is confined to the vulnerable .NET Framework component and the system it runs on. Given the near-certain exploitation probability indicated by the 99.88th percentile EPSS score, organizations running affected .NET Framework versions face critical risk if patches are not applied.
Exploit Maturity
CVE-2017-8759 has a mature exploit landscape with multiple public exploits available. Public exploit code is available via GitHub (bhdresh) and GitHub (nccgroup), providing readily usable proof-of-concept tools. CISA has confirmed active exploitation in the wild through its KEV catalog listing. The EPSS score of 93.95% (99.88th percentile) indicates near-certain exploitation activity, placing this among the most actively targeted vulnerabilities. The original exploitation was attributed to targeted attack campaigns using specially-crafted Office documents leveraging the .NET Framework SOAP WSDL parsing flaw.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Microsoft released security patches in September 2017 addressing this vulnerability.
- Update all affected .NET Framework installations to patched versions. The following versions are vulnerable and require updating: .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, and 4.7.
- As interim mitigations, restrict the ability to open documents from untrusted sources in Microsoft Office applications, enable Protected View, and disable macros from untrusted publishers.
- Monitor systems for indicators of compromise, including unusual .NET process activity, unexpected code execution from Office applications, and suspicious network connections originating from .NET runtime processes.
- Implement application whitelisting and code signing policies to prevent unauthorized code execution through .NET Framework components, and conduct a thorough review of all systems that may have been exposed prior to patching.
Technical Details
CVE-2017-8759 exploits a code injection vulnerability (CWE-94) in the Microsoft .NET Framework's SOAP WSDL parser. The flaw exists in how the .NET Framework processes untrusted input when parsing WSDL definitions, where a specially-crafted SOAP response can inject arbitrary code that is executed during the code generation phase. The attack is delivered through a malicious document or application that triggers the .NET Framework to process the crafted WSDL content. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that while the attack vector is local (requiring document delivery), exploitation complexity is low, no privileges are needed, and the impact across confidentiality, integrity, and availability is high. Multiple .NET Framework versions from 2.0 through 4.7 are affected, indicating a broad attack surface across enterprise environments.
Frequently Asked Questions
Is CVE-2017-8759 being actively exploited?
Yes. CVE-2017-8759 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Multiple public exploit tools are available on GitHub, and the EPSS score of 93.95% (99.88th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2017-8759?
CVE-2017-8759 affects multiple versions of the Microsoft .NET Framework, including versions 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, and 4.7. Any system running these .NET Framework versions is potentially vulnerable.
How do I fix CVE-2017-8759?
Apply the security patches released by Microsoft in September 2017 for all affected .NET Framework versions. As interim measures, restrict document opening from untrusted sources, enable Protected View in Office applications, and monitor for indicators of compromise.
How severe is CVE-2017-8759?
CVE-2017-8759 has a CVSS 3.1 score of 7.8 (HIGH) with high impact across confidentiality, integrity, and availability. The EPSS score in the 99.88th percentile makes this one of the most likely-to-be-exploited vulnerabilities, requiring immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.