Overview
DoS risk arises when ASP.NET Core encoders miscalculate the length of 4-byte Unicode characters in certain inputs, causing excessive CPU consumption during request processing. CVE-2017-0247 documents that a flaw in the TextEncoder.EncodeCore path within System.Text.Encodings.Web (affecting ASP.NET Core MVC before 1.0.4 and 1.1.x before 1.1.3) can be exploited by crafted inputs to exhaust server resources. This vulnerability aligns with CWE-20 Denial of Service and was addressed by Microsoft in patched releases.
In practice, an attacker can send specially crafted payloads that require heavy encoding work during response generation. Even ordinary inputs can trigger CPU exhaustion in high-load environments. The vulnerability resides in the encoding library rather than in application logic, so fixes come from upgrading the dependency rather than reworking business code.
Remediation for ASP.NET Core requires upgrading to patched libraries (System.Text.Encodings.Web 1.0.4+ or 1.1.3+). After upgrading, validate behavior with unit/integration tests and load tests. Additionally, mitigate future risk by enforcing request size limits, enabling rate limiting, and performing boundary validation on untrusted input at the edge.
Affected Versions
ASP.NET Core MVC 1.0.x before 1.0.4 and 1.1.x before 1.1.3 are affected; patched versions are 1.0.4+ and 1.1.3+.
Code Fix Example
ASP.NET Core API Security Remediation
/* VULNERABLE PATTERN */
// Controller using HtmlEncoder before patch (CVE-2017-0247)
using Microsoft.AspNetCore.Mvc;
using System.Text.Encodings.Web;
public class DemoController : Controller {
[HttpGet] public IActionResult Echo(string input) {
// Potential DoS under CVE-2017-0247 when encoding long/unusual Unicode input with an unpatched encoder
var encoded = HtmlEncoder.Default.Encode(input);
return Content(encoded, \"text/html\");
}
}
/* FIX - upgrade to patched System.Text.Encodings.Web (1.0.4+ or 1.1.3+) */
// Update package reference in your .csproj
// <PackageReference Include=\"System.Text.Encodings.Web\" Version=\"1.1.3\" />
// Build/Run the app to pick up the patched library
using Microsoft.AspNetCore.Mvc;
using System.Text.Encodings.Web;
public class DemoControllerFixed : Controller {
[HttpGet] public IActionResult Echo(string input) {
var encoded = HtmlEncoder.Default.Encode(input);
return Content(encoded, \"text/html\");
}
}