CVE-2026-69304
MEDIUM(5.9)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 5.9 — Mittel
Erwähnungen (letzte 60 Tage)
EPSS-Score
0.8%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
5.9
Technische Schwere
Beschreibung
Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Erkennung & Indikatoren
Ausnutzung
In den geprüften Quellen nicht genannt
Behobene Versionen
- ASP.NET Core 10.0 versions antérieures à 10.0.12
- ASP.NET Core 11.0 versions antérieures à 11.0 RC1
- ASP.NET Core 8.0 versions antérieures à 8.0.31
- ASP.NET Core 9.0 versions antérieures à 9.0.20
Threat-Hunting-Queries
Detection for denial of service due to data amplification in ASP.NET Core. Look for unusual network traffic patterns or resource consumption.
Sentinel/Defender KQL
let threshold = 1000000; // Example: 1MB per request or similar anomaly
let timeWindow = 5m;
HttpRequests
| where Url contains "/" // Adjust to specific ASP.NET Core application paths if known
| summarize TotalBytesReceived = sum(RequestSize), RequestCount = count() by bin(Timestamp, timeWindow), ClientIP
| where TotalBytesReceived > threshold
| project Timestamp, ClientIP, TotalBytesReceived, RequestCount, Anomaly = "Potential Data Amplification DoS"
| extend Reason = "High volume of data received, potentially indicating data amplification attack."Splunk SPL
sourcetype=iis_access_logs cs_uri_stem="/" | bin _time span=5m | stats sum(sc_bytes) as TotalBytesReceived, count as RequestCount by _time, c_ip | where TotalBytesReceived > 1000000 | table _time, c_ip, TotalBytesReceived, RequestCountSigma
title: ASP.NET Core Data Amplification DoS
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential data amplification denial of service attacks against ASP.NET Core applications.
author: SecBoard
date: 2026/09/09
logsource:
product: iis
service: access
detection:
selection:
cs_uri_stem: '/'
timeframe: 5m
condition: selection | stats sum(sc_bytes) as TotalBytesReceived, count as RequestCount by c_ip | where TotalBytesReceived > 1000000
level: highElastic ES|QL
from iis_access_logs
| where url.path : "/"
| summarize TotalBytesReceived = sum(http.request.body.bytes), RequestCount = count() by span(timestamp, 5m), source.ip
| where TotalBytesReceived > 1000000
| select timestamp, source.ip, TotalBytesReceived, RequestCountSecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.
GitHub Advisories
Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability