Deserialization vulns: past, present, and future
summary
Survey of .NET deserialization that names which serializers and configurations that are vulnerable, shows a concrete gadget that uses a multicast delegate + reflection to swap in Process.Start and launches calc, and documents RCE chains found in Azure DevOps/TFS YAML parsing (requires repo write plus admin UI trigger but a working XSS escalation demo exists). Includes a prototype static analyzer (Panzer) and a published payload collection for generating and testing exploits; tools successfully find real Microsoft bugs.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:48History of vulnerabilities
- 9:14Gadgets and RCE
- 12:10XML and JSON serialization flaws
- 16:45Research overview
- 19:23New Azure DevOps flaws
- 27:50Untrusted data
- 31:24Vulnerability scanners
- 33:52Future of serialization attacks
- 38:32Security best practices
- 48:18Recommendations and conclusion
related talks
44mSecond Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NET
35mHow To Find The Next Great Deserialization CVE
24mSecond Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NET
45mThe Code Behind The Vulnerability
41mFriday the 13th: Attacking JSON
58mThe Code Behind The Vulnerability
34mDeserialization: what, how and why [not]
01h 01mThe Code Behind The Vulnerability