CVE-2024-29059

CVE-2024-29059 is an information disclosure flaw in Microsoft .NET Framework (CWE-209), in which error handling can generate error messages containing sensitive information. Per the CVSS vector, it is exploitable over the network by an unauthenticated attacker with no user interaction, with high impact to confidentiality only. An attacker who can reach an affected application can trigger the flaw and harvest sensitive details from error output, which can support further attacks against the host or its users. Any organization running affected .NET Framework versions, most commonly on Windows servers hosting ASP.NET/.NET web workloads, is in scope. The vulnerability is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-02-04 with a remediation deadline of 2025-02-25, EPSS puts the 30-day exploitation probability at 98.6%, and no public proof-of-concept is known while ransomware use is unconfirmed.

What to do: Apply Microsoft's current monthly security updates for affected .NET Framework versions as soon as possible, ahead of CISA's February 25, 2025 KEV deadline. Inventory Windows hosts and prioritize internet-facing servers and systems running ASP.NET/.NET Framework applications, confirming installed .NET Framework versions against Microsoft's advisory. If patching must be delayed, follow vendor-recommended mitigations or restrict network access to affected applications until updates are applied.