Second Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NET

on YouTube ↗24m

" summary

Demonstrates concrete RCEs by crafting serialized payloads and showstopping mutations that turn innocuous key/value maps into gadgets, successfully exploiting LiteDB, MongoDB, RavenDB, ServiceStack.Redis, MartenDB, JSON.Net and the .NET JavaScriptSerializer. Describes the mutation-based serialization trick (put "$type" into a string→string dictionary), an implicit serialization danger where libraries deserialize storage for callers, and multiple serialization binder bypass techniques via generics and contagion. Recommends removing polymorphic serializers and unsafe settings; most vendors patch differently and JSON.Net refuses to change.

AI-written summary · about

" chapters (17)

1. 0:00Introduction
2. 0:17Understanding type get type
3. 1:43LiteDB serialization
4. 2:54Deserialization gadgets
5. 4:35Implicit vulnerabilities
6. 6:12NoSQL client risks
7. 6:54Vulnerabilities in MongoDB
8. 8:16RavenDB and ServiceStack
9. 9:37MartinDB and mutations
10. 11:18Mutation attack mechanics
11. 13:28Impact of mutation attacks
12. 15:22Vulnerable serializers
13. 16:24Defending against attacks
14. 16:51Bypassing security binders
15. 18:58Binder bypass examples
16. 20:35Vendor fixes and status
17. 21:50Conclusion and Q&A

" related talks

• 44mSecond Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NETJonathan Birch · NDC Security 2024
• 49mDeserialization vulns: past, present, and futureMykhayl Shcherbakov · DotNext 2019 Piter
• 35mDangerous SerializationIvan Yushkevich · РИТ++ 2017
• 41mFriday the 13th: Attacking JSONAlvaro Munoz, Oleksandr Mirosh · AppSec USA 2017
• 01h 01mThe Code Behind The VulnerabilityBarry Dorrans · NDC Sydney 2018
• 45mThe Code Behind The VulnerabilityBarry Dorrans · Øredev 2018
• 41mJava Serialisation: A Modern FairytaleStephen Hellberg · JAX London 2019
• 58mThe Code Behind The VulnerabilityBarry Dorrans · NDC Sydney 2017