Microsoft ASP.NET Core project templates vulnerable to denial of service
Date: 2024-01
Affected: nuget/Microsoft.IdentityModel.JsonWebTokens, nuget/Microsoft.IdentityModel.JsonWebTokens, nuget/Microsoft.IdentityModel.JsonWebTokens
Attack vector: dos
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-21319
CWE: CWE-400
CVSS: 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)

A Denial of Service vulnerability exists in ASP.NET Core project templates which utilize JWT-based authentication tokens. This vulnerability allows an unauthenticated client to consume arbitrarily large amounts of server memory, potentially triggering an out-of-memory condition on the server and making the server no longer able to respond to legitimate requests. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/290 ### Mitigation factors This impacts only .NET Core-based projects that were created using any version of project templates listed in affected software. Other project templates e.g., console applications, MAUI applications, Windows Forms or WPF applications, are not affected. ## Affected software This impacts only .NET Core-based projects that were created using any version of the below project templates. - ASP.NET Core Web App (Model-View-Controller) - ASP.NET Core Web API - ASP.NET Core Web App (Razor Pages) - Blazor Server App - Blazor WebAssembly App ## Advisory FAQ ### How do I know if I am affected? If you are you using project templates listed in affected software, you may be exposed to the vulnerability. ### How do I fix the issue? #### For existing projects: If you ever created any of these projects via the dotnet new command or via Visual Studio's File -> New Project gesture, and if you enabled federated authentication at project creation time, your project may be vulnerable. To remedi


Mitigations:

Architectural layers (MAESTRO):