Unsafe reflection / dynamic type loading from user input

ID

vbnet.inject.unsafe_reflection

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Inject

Language

VB.NET

Description

User-controlled input flows into .NET reflection / dynamic type loading (Assembly.Load/LoadFrom/LoadFile, Type.GetType, Activator.CreateInstance, InvokeMember or MethodInfo.Invoke). An attacker who controls the assembly path, type name or member name can load and execute arbitrary code, leading to remote code execution. Restrict reflection targets to a strict allow-list of permitted assemblies, types and methods, and never derive them from untrusted input.

Rationale

User-controlled input flows into .NET reflection / dynamic type loading (Assembly.Load/LoadFrom/LoadFile, Type.GetType, Activator.CreateInstance, InvokeMember or MethodInfo.Invoke). An attacker who controls the assembly path, type name or member name can load and execute arbitrary code, leading to remote code execution. Restrict reflection targets to a strict allow-list of permitted assemblies, types and methods, and never derive them from untrusted input.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub LoadFromQueryString(ByVal Request As HttpRequest)
    ' VULNERABLE: Unsafe reflection / dynamic type loading from user input
    Dim asm As Assembly = Assembly.Load(Request.QueryString("plugin"))
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References