Insecure deserialization of untrusted data
ID |
vbnet.inject.code_injection_deserialization |
Severity |
high |
Remediation Complexity |
hard |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Inject |
Language |
VB.NET |
Description
Insecure deserialization sink. BinaryFormatter, SoapFormatter, LosFormatter, ObjectStateFormatter and NetDataContractSerializer deserialize arbitrary object graphs and can lead to remote code execution when fed untrusted data. The same risk applies to JavaScriptSerializer configured with a SimpleTypeResolver, Newtonsoft Json.NET with a non-None TypeNameHandling, and DataSet/DataTable ReadXml/ReadXmlSchema (CVE-2020-1147), all of which resolve arbitrary CLR types from the payload. Stop using these formatters/settings; use a safe, type-restricted serializer such as System.Text.Json or DataContractJsonSerializer, and never enable polymorphic type resolution on untrusted input.
Rationale
Insecure deserialization sink. BinaryFormatter, SoapFormatter, LosFormatter, ObjectStateFormatter and NetDataContractSerializer deserialize arbitrary object graphs and can lead to remote code execution when fed untrusted data. The same risk applies to JavaScriptSerializer configured with a SimpleTypeResolver, Newtonsoft Json.NET with a non-None TypeNameHandling, and DataSet/DataTable ReadXml/ReadXmlSchema (CVE-2020-1147), all of which resolve arbitrary CLR types from the payload. Stop using these formatters/settings; use a safe, type-restricted serializer such as System.Text.Json or DataContractJsonSerializer, and never enable polymorphic type resolution on untrusted input.
The following code illustrates a vulnerable pattern detected by this rule:
Public Function OneLinerBinary(stream As Stream) As Object
' VULNERABLE: Insecure deserialization of untrusted data
Return New BinaryFormatter().Deserialize(stream)
End Function