CVE-2017-11770

What it actually does

The vulnerability is a remotely triggerable denial-of-service condition caused by improper parsing of malformed certificate data. In affected .NET Core 1.0, 1.1, and 2.0 web applications, unauthenticated network input containing crafted certificate material can cause excessive error handling, process instability, crashes, or service unavailability. The provided affected-product metadata also references mongodb/js-bson and a fixing Git commit; where that mapping applies, consumers should treat vulnerable dependency versions before commit bd61c45157c53a1698ff23770160cf4783e9ea4a as requiring update or replacement.

Why it matters to the business

Successful exploitation can make affected web applications unavailable without requiring credentials, interrupting customer-facing services, APIs, internal applications, or dependent business workflows. The issue is not known to be in CISA KEV, is not flagged for ransomware use, and has no listed public exploit maturity, but it has a network-reachable unauthenticated attack surface and a high availability impact, so internet-facing or business-critical services should still be prioritized for remediation.

How an attack unfolds

An attacker identifies an application path or workflow that causes the server to parse certificate data, such as client-certificate handling, certificate upload/import, authentication middleware, or an API parameter carrying certificate material. The attacker sends malformed or specially crafted certificate data over the network without authenticating. The vulnerable runtime or affected parser mishandles the certificate structure during parsing, which may produce repeated exceptions, crash the application process, trigger worker recycling, or consume resources. By repeating the request or coordinating multiple sources, the attacker can sustain service disruption until the vulnerable runtime, library, or application component is patched or protected.

How to fix it

Upgrade affected .NET Core applications to a supported, patched runtime; .NET Core 1.0, 1.1, and 2.0 are end-of-life and should be replaced with a currently supported .NET release. Rebuild and redeploy applications against the patched runtime and verify all hosting images, containers, build agents, and runtime bundles are updated. If inventory identifies mongodb/js-bson as the affected package in this finding, update to commit bd61c45157c53a1698ff23770160cf4783e9ea4a or a later release containing that fix. As compensating controls, restrict unauthenticated certificate-processing endpoints, enforce strict input size and format limits, reject invalid certificate encodings before deeper parsing, add rate limiting, and isolate high-risk parsing workflows from critical application processes.

How to confirm the fix worked

Confirm runtime and dependency inventory no longer includes .NET Core 1.0, 1.1, or 2.0, and confirm any mapped mongodb/js-bson dependency is at or after commit bd61c45157c53a1698ff23770160cf4783e9ea4a. Validate container images and deployment artifacts, not just source repositories. Review package manifests, lockfiles, SBOMs, runtime banners, and host-level dotnet --info output where available. Perform controlled negative testing with malformed certificate inputs in a non-production environment and verify the application returns a safe validation error without crashing, recycling, or materially increasing CPU or memory use. Monitor after deployment for disappearance of certificate parsing exceptions and application crash/restart events associated with malformed requests.

Typical attack path

1. Discover a web application or API running an affected .NET Core 1.0, 1.1, or 2.0 stack, or an application dependency mapped to the vulnerable component.
2. Identify endpoints or request flows that accept, forward, or parse certificate data.
3. Send malformed certificate content in a request body, header, file upload, or protocol field that reaches the vulnerable parser.
4. Trigger parser failure, unhandled exception, process crash, worker recycle, or resource exhaustion.
5. Repeat the malformed requests to keep the service degraded or unavailable.

How to detect it

Look for evidence of repeated malformed certificate parsing immediately preceding service degradation, process crashes, or application restarts. Useful sources include application logs, ASP.NET Core/Kestrel logs, reverse proxy and load balancer logs, web access logs, Windows Application Event Logs, Linux syslog/journald, container runtime logs, Kubernetes restart events, crash dumps, and APM traces. Hunt for unauthenticated requests to endpoints related to authentication, certificate upload/import, enrollment, mutual TLS, API gateways, or identity flows, especially when followed by HTTP 500 responses, connection resets, worker process recycling, dotnet process termination, coredumps, or elevated CPU/memory. Because this is a denial-of-service flaw, indicators are primarily behavioral: bursts of malformed requests from one or more sources, certificate/ASN.1 parsing exceptions, and correlated availability events. No named threat actors or ransomware campaigns are provided for this issue, and it is not listed in KEV, so detection should focus on generic abuse patterns rather than actor-specific infrastructure.

• System.Security.Cryptography.CryptographicException
• System.Security.Cryptography.X509Certificates
• X509Certificate2
• ASN1 corrupted data
• ASN1 bad tag value met
• Cannot find the requested object
• Microsoft.AspNetCore.Server.Kestrel
• Faulting application name: dotnet.exe
• Application: dotnet.exe
• dotnet.exe
• core dumped
• Segmentation fault
• OutOfMemoryException
• StackOverflowException
• HTTP 500
• connection reset by peer
• CrashLoopBackOff
• Back-off restarting failed container

What your security team should do

• Prioritize internet-facing and unauthenticated applications that parse client certificates, uploaded certificates, or certificate-like request data.
• Remove or upgrade all .NET Core 1.0, 1.1, and 2.0 runtimes because they are end-of-life and may contain multiple unresolved security issues.
• If dependency scanning maps exposure to mongodb/js-bson, update to commit bd61c45157c53a1698ff23770160cf4783e9ea4a or later and regenerate lockfiles/SBOMs.
• Add rate limiting, request body size limits, and strict allow-list validation for endpoints that accept certificate material.
• Create detections for bursts of certificate parsing errors followed by dotnet process crashes, worker recycling, HTTP 500 spikes, or service restarts.
• Review historical logs for exploitation attempts, especially against authentication, certificate enrollment, upload, import, and API gateway paths.
• Document the finding as availability-impacting rather than data-theft-oriented; response should focus on service resilience, patching, and abuse prevention.