Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-0982

CVE-2019-0982: Denial of service in ASP.NET Core

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2019-0982
GHSA ID
GHSA-4jxx-4qxw-prxm
EPSS Score
0.88626%
CWE
-
Published
5/24/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
Microsoft.AspNetCore.SignalR.Protocols.MessagePacknuget>= 1.1.0, < 1.1.51.1.5
Microsoft.AspNetCore.SignalR.Protocols.MessagePacknuget>= 1.0.0, < 1.0.111.0.11

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability exists in SignalR's MessagePack protocol implementation, which handles web request processing. The advisory specifically mentions improper request handling leading to DoS, and MessagePackHubProtocol is the core component for MessagePack message processing. The ReadMessage method is the primary deserialization entry point where improper input validation would manifest. The patched versions (1.0.11/1.1.5) likely added size limits and validation checks in this deserialization path.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* **ni*l o* s*rvi** vuln*r**ility *xists w**n *SP.N*T *or* improp*rly **n*l*s w** r*qu*sts, *k* '*SP.N*T *or* **ni*l o* S*rvi** Vuln*r**ility'.

Reasoning

T** vuln*r**ility *xists in Si*n*lR's M*ss***P**k proto*ol impl*m*nt*tion, w*i** **n*l*s w** r*qu*st pro**ssin*. T** **visory sp**i*i**lly m*ntions improp*r r*qu*st **n*lin* l***in* to *oS, *n* `M*ss***P**k*u*Proto*ol` is t** *or* *ompon*nt *or M*ss*