CVE-2011-3414 in .NET Framework
Summary
by MITRE
The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 01/26/2025
The vulnerability described in CVE-2011-3414 represents a critical weakness in the .NET Framework's HashTable implementation that enables remote attackers to execute denial of service attacks through predictable hash collisions. This flaw exists within the CaseInsensitiveHashProvider.getHashCode function which is responsible for generating hash values for form parameters processed by ASP.NET applications. The vulnerability affects multiple versions of the .NET Framework including 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0, making it particularly widespread across legacy systems. The fundamental issue lies in the hash function's inability to prevent attackers from crafting specific input parameters that will consistently map to the same hash bucket, thereby degrading the HashTable's performance characteristics from optimal O(1) to worst-case O(n) operations.
The technical exploitation of this vulnerability occurs when an attacker sends numerous crafted form parameters to an ASP.NET application, each designed to produce the same hash value and consequently occupy the same bucket in the HashTable structure. As the number of colliding parameters increases, the HashTable's performance degrades significantly because it must handle each collision by maintaining a linked list or similar structure to store multiple items in the same bucket. This results in the CPU consumption spiraling upward as the application processes increasingly complex hash collision chains, ultimately leading to system resource exhaustion and denial of service conditions. The vulnerability specifically targets the hash computation algorithm used in the ASP.NET subsystem, making it particularly dangerous for web applications that process user input through form parameters.
From an operational perspective, this vulnerability poses severe risks to web applications and services that rely on the .NET Framework's default HashTable behavior for processing form data. Attackers can exploit this weakness by crafting HTTP requests containing hundreds or thousands of parameters that all hash to the same value, effectively causing the application server to consume excessive CPU cycles and potentially become unresponsive. The impact extends beyond simple service disruption to potentially affect multiple concurrent users if the application's processing thread pool becomes saturated with hash collision handling operations. This vulnerability aligns with CWE-311 in the Common Weakness Enumeration, which specifically addresses the lack of protection of sensitive data, though in this case the weakness manifests as a lack of protection against hash collision attacks. The attack pattern also corresponds to techniques described in the MITRE ATT&CK framework under the T1499 category for resource exhaustion attacks, where adversaries consume system resources to prevent legitimate use of services.
Mitigation strategies for this vulnerability require a combination of immediate patches, application-level protections, and architectural considerations. Microsoft has released security updates for all affected versions of the .NET Framework, and organizations should prioritize applying these patches as soon as possible to eliminate the vulnerability at its source. Additionally, application developers can implement input validation and parameter sanitization to limit the number of parameters processed in a single request, thereby reducing the potential impact of collision attacks. Organizations should also consider implementing rate limiting and request size restrictions at the network level to prevent attackers from overwhelming the system with excessive parameter counts. The vulnerability demonstrates the importance of secure hash function implementation and highlights the need for robust collision handling mechanisms in cryptographic and data structure implementations. System administrators should monitor for unusual CPU consumption patterns and implement intrusion detection systems that can identify potential exploitation attempts through abnormal parameter processing behaviors.