Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-0602

CVE-2020-0602: Denial of service in ASP.NET Core

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-0602
GHSA ID
GHSA-23cv-jh4v-vffm
EPSS Score
0.88129%
CWE
CWE-400
Published
5/24/2022
Updated
1/30/2023
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
Microsoft.AspNetCore.Allnuget>= 2.1.0, < 2.1.152.1.15
Microsoft.AspNetCore.Appnuget= 3.1.03.1.1
Microsoft.AspNetCore.Appnuget= 3.0.03.0.1
Microsoft.AspNetCore.Appnuget>= 2.1.0, < 2.1.152.1.15
Microsoft.AspNetCore.Http.Connectionsnuget>= 1.0.0, < 1.0.151.0.15
Microsoft.AspNetCore.App.Runtime.linux-armnuget>= 3.1.0, < 3.1.13.1.1
Microsoft.AspNetCore.App.Runtime.linux-arm64nuget>= 3.1.0, < 3.1.13.1.1
Microsoft.AspNetCore.App.Runtime.linux-musl-x64nuget>= 3.1.0, < 3.1.13.1.1
Microsoft.AspNetCore.App.Runtime.linux-x64nuget>= 3.1.0, < 3.1.13.1.1
Microsoft.AspNetCore.App.Runtime.osx-x64nuget>= 3.1.0, < 3.1.13.1.1
Microsoft.AspNetCore.App.Runtime.win-armnuget>= 3.1.0, < 3.1.13.1.1
Microsoft.AspNetCore.App.Runtime.win-x64nuget>= 3.1.0, < 3.1.13.1.1
Microsoft.AspNetCore.App.Runtime.win-x86nuget>= 3.1.0, < 3.1.13.1.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper backpressure management in ASP.NET Core's SignalR component. Key evidence includes:

  1. CVE-2020-0602's description explicitly references SignalR backpressure issues
  2. Red Hat's errata links the vulnerability to dotnet: 'SignalR Denial of Service via backpressure issue'
  3. The Microsoft advisory (aspnet/Announcements#402) specifies Http.Connections package as vulnerable
  4. Backpressure failures in connection management components are classic CWE-400 vectors
  5. HttpConnectionManager and HttpConnectionDispatcher are core SignalR components responsible for connection lifecycle management and request processing

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* **ni*l o* s*rvi** vuln*r**ility *xists w**n *SP.N*T *or* improp*rly **n*l*s w** r*qu*sts, *k* '*SP.N*T *or* **ni*l o* S*rvi** Vuln*r**ility'.

Reasoning

T** vuln*r**ility st*ms *rom improp*r ***kpr*ssur* m*n***m*nt in *SP.N*T *or*'s Si*n*lR *ompon*nt. K*y *vi**n** in*lu**s: *. *V*-****-****'s **s*ription *xpli*itly r***r*n**s Si*n*lR ***kpr*ssur* issu*s *. R** **t's *rr*t* links t** vuln*r**ility to