Serialization vulnerabilities can lead to data disclosure or remote code execution warns Context in white paper published today.
At this week’s Black Hat USA conference in Las Vegas, one of Context’s Principal Consultants, James Forshaw, will be presenting details of vulnerabilities discovered in the .NET framework that allow malicious remote code execution from within the .NET framework. James' white paper, ‘Breaking .NET Through Serialization’ is also available for download.
Earlier this year, Microsoft released a patch to mitigate the risks after Context made Microsoft aware of the .NET vulnerabilities and helped to fix the issues. The patch makes changes to the workings of the serialization framework, a fundamental feature of .NET applications that allows data or objects to be easily transferred and stored. The risks identified by Context could allow an attacker to target an application, either via a remote interface or through code running within a sandbox, in order to disclose information such as authentication details or to circumvent security measures to execute code under malicious control. The applications in question could be remotely accessible business services, local privileged applications or sandboxed environments such as XAML browser applications.
"The process of serialization is a fundamental function of a number of common application frameworks due to the power it provides a developer,” says James Forshaw. “The .NET framework provides many such techniques to serialize the state of objects but by far the most powerful is the Binary Formatter, a set of functionality built into the framework since v1.0. The power provided by this serialization mechanism, the length of time it has been present, as well as the fact it is tied so closely into the .NET runtime, makes it a significant attack threat."
The Context whitepaper describes some of the fundamental vulnerabilities which allow remote code execution, privilege escalation and information disclosure attacks against not just sandboxed .NET code such as in the browser, but also remote network services using common framework libraries. Understanding the attack techniques, which could also apply to other serialization technologies, will help developers to avoid common mistakes with binary serialization.
More information about Black Hat
Download the Microsoft patch here.
Read the white paper here.