CVE-2024-43498

What it actually does

Unsafe deserialization in .NET 9.0 allows remote unauthenticated attackers to execute arbitrary code by processing specially crafted requests or files that instantiate malicious objects during deserialization.

Why it matters to the business

Attackers can fully compromise affected applications, resulting in unauthorized access to sensitive data, system takeover, and operational disruption; urgency is moderate given low EPSS and lack of KEV listing despite high CVSS.

How an attack unfolds

An attacker identifies a vulnerable .NET web application, crafts a malicious serialized payload, and delivers it via HTTP request or file upload; the application deserializes the payload without validation, triggering code execution on the server.

How to fix it

Upgrade affected .NET 9.0 applications to the latest patched version that resolves the deserialization issue; apply vendor updates promptly.

How to confirm the fix worked

Verify application versions against fixed releases, review deserialization code paths for safe type filtering, and perform authenticated scans or fuzzing to confirm the vulnerability is closed.

Typical attack path

1. Reconnaissance to identify exposed .NET 9.0 web applications
2. Craft and send specially crafted deserialization payload via request or file
3. Trigger deserialization to achieve remote code execution
4. Establish persistence or exfiltrate data

How to detect it

Inspect web server logs for unusual request patterns containing serialized object markers, review application error logs for deserialization exceptions, and search for unexpected process spawns following web requests.

What your security team should do

• Prioritize patching all .NET 9.0 instances within standard change windows
• Implement input validation and safe deserialization patterns in code reviews
• Monitor EPSS trends and enable application runtime protections such as WAF rules for deserialization patterns