CVE-2024-29059
Microsoft .NET Framework Information Disclosure Vulnerability
Description
CVE-2024-29059 is a high-severity information disclosure vulnerability in Microsoft .NET Framework that allows a remote unauthenticated attacker to obtain sensitive information from affected systems. With a CVSS v3.1 base score of 7.5, the flaw exposes internal data that can be leveraged to further compromise the target environment. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 25, 2025, and the ransomware association is currently classified as unknown. The EPSS score of 93.88% at the 99.9th percentile signals near-certain exploitation probability, placing this vulnerability among the most actively targeted flaws in the entire tracked vulnerability landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | .net framework | 3.5; 4.7.2; 4.8; 3.5.1; 2.0; 3.0; 4.6; 4.6.2; 4.8.1; 4.7; 4.7.1 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29059(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-29059(US Government Resource)
Weakness Type
Unknown CWE
CVE-2024-29059 does not have a specific CWE assigned in the NVD database. The vulnerability is classified as an information disclosure flaw in the .NET Framework. Information disclosure vulnerabilities in framework components typically arise from improper handling of error messages, debug information, or internal state data that is inadvertently exposed to remote clients. In the context of .NET Framework, this can include exposure of internal object references, stack traces containing file paths, assembly version information, configuration details, or memory contents that should not be accessible to external requests. Such disclosed information can serve as a stepping stone for more severe attacks by revealing internal architecture details, valid paths, or other data that reduces the attacker's effort in identifying further exploitation targets. Learn more about Information Exposure vulnerabilities
Impact Analysis
The impact of CVE-2024-29059 is focused on confidentiality, which is rated as high, while integrity and availability are not directly affected. Confidentiality is the primary concern because the vulnerability exposes sensitive internal information to remote unauthenticated attackers. The disclosed data could include internal URIs, file paths, assembly metadata, configuration details, or other framework-internal information that provides attackers with valuable intelligence for planning subsequent attacks against the target environment.
While integrity and availability are not directly impacted by the information disclosure itself, the exposed information significantly lowers the barrier for follow-up attacks that could compromise these dimensions. Detailed knowledge of the internal .NET Framework version, application structure, and configuration enables attackers to select precisely targeted exploits for known vulnerabilities in specific framework versions. The EPSS score of 93.88% at the 99.9th percentile confirms that this vulnerability is being exploited at an extraordinarily high rate, ranking in the top 0.1% of all tracked vulnerabilities. The affected versions span a wide range of .NET Framework releases including versions 2.0, 3.0, 3.5, 3.5.1, 4.6, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and 4.8.1, representing virtually every currently supported and many legacy .NET Framework installations. The network-accessible attack vector with no authentication or user interaction required makes this vulnerability trivially exploitable at scale.
Exploit Maturity
CVE-2024-29059 demonstrates maximum exploit maturity through its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of February 25, 2025. The EPSS score of 93.88% at the 99.9th percentile reflects the highest tier of exploitation activity, confirming that this vulnerability is more actively exploited than 99.9% of all tracked vulnerabilities. The official Microsoft advisory is available at the Microsoft Security Response Center.
The extremely high EPSS score indicates that threat actors have incorporated exploitation of this vulnerability into automated scanning and attack toolkits. The combination of network accessibility, no authentication requirement, no user interaction, and low attack complexity creates ideal conditions for mass exploitation. The wide range of affected .NET Framework versions ensures a large target population across enterprise environments, web servers, and application servers. The CISA KEV entry can be reviewed at the KEV catalog. While classified as an information disclosure vulnerability, the real-world exploitation pattern suggests that the disclosed information is valuable enough to warrant dedicated exploitation effort, likely because it enables or significantly facilitates more severe follow-up attacks.
Remediation
-
Apply the Microsoft security update for .NET Framework immediately across all affected systems. The vulnerability affects .NET Framework versions 2.0, 3.0, 3.5, 3.5.1, 4.6, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and 4.8.1. Consult the Microsoft Security Response Center advisory for the specific KB articles corresponding to each framework version and operating system combination.
-
Deploy updates through Windows Update or WSUS for managed environments. .NET Framework security updates are distributed through standard Windows Update channels. For environments using Windows Server Update Services (WSUS) or Microsoft Configuration Manager, approve and deploy the relevant updates to all applicable systems immediately.
-
Prioritize internet-facing systems for immediate patching, as the network-accessible attack vector means any .NET Framework application reachable from the internet is a potential target. Web servers running ASP.NET applications, WCF services, and any other .NET-based services exposed to untrusted networks should receive updates first.
-
Verify patch installation across the environment by checking installed .NET Framework versions and update levels. Use the registry key HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP to confirm framework versions and their update status. Automated compliance reporting through system management tools should be configured to flag systems that remain unpatched.
-
Implement defense-in-depth measures including web application firewalls configured to detect and block information disclosure patterns, custom error pages that suppress detailed .NET error information from reaching external users, and network segmentation that limits the exposure of .NET Framework applications to only necessary network segments.
Technical Details
CVE-2024-29059 is an information disclosure vulnerability in Microsoft .NET Framework, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Breaking down the vector components: Attack Vector (AV:N) indicates the vulnerability is exploitable over the network without local or physical access. Attack Complexity (AC:L) means exploitation works reliably without special conditions. Privileges Required (PR:N) confirms no authentication is needed to trigger the information disclosure. User Interaction (UI:N) indicates no victim action is required. Scope (S:U) means the impact remains within the .NET Framework application context. The impact ratings show Confidentiality (C:H) as high while Integrity (I:N) and Availability (A:N) are not affected, consistent with a pure information disclosure vulnerability.
The .NET Framework processes certain requests in a manner that inadvertently exposes sensitive internal information to remote clients. The specific technical mechanism involves improper handling of data that should be restricted to internal processing, resulting in its inclusion in responses visible to the requester. The breadth of affected versions — spanning .NET Framework 2.0 through 4.8.1 — suggests the vulnerable code path has been present in the framework for a long period and affects a core component rather than a version-specific feature. The high confidentiality impact rating indicates that the disclosed information is substantively sensitive, not merely version banners or minor metadata. Applications built on any of the affected .NET Framework versions that are accessible over the network are vulnerable, regardless of the specific application logic, because the flaw exists in the framework itself rather than in application code.
Frequently Asked Questions
What is CVE-2024-29059?
CVE-2024-29059 is a high-severity information disclosure vulnerability in Microsoft .NET Framework that allows remote unauthenticated attackers to obtain sensitive internal information from affected applications. It carries a CVSS score of 7.5 and has been added to CISA's KEV catalog.
Which .NET Framework versions are affected by CVE-2024-29059?
The vulnerability affects .NET Framework versions 2.0, 3.0, 3.5, 3.5.1, 4.6, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and 4.8.1. This covers virtually every currently supported and many legacy .NET Framework installations.
Can CVE-2024-29059 be exploited remotely?
Yes, CVE-2024-29059 is exploitable remotely over the network with no authentication required and no user interaction needed. Any .NET Framework application accessible from the network is a potential target.
How severe is the active exploitation of CVE-2024-29059?
The EPSS score of 93.88% at the 99.9th percentile indicates near-certain exploitation, placing it among the most actively exploited vulnerabilities globally. CISA has listed it in the KEV catalog with a remediation deadline of February 25, 2025.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.