Second Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NET
summary
Demonstrates concrete remote code execution across .NET serializers: proven RCEs against LiteDB, MongoDB, RavenDB, ServiceStack.Redis and MartenDB using gadgets like AssemblyInstaller and ObjectDataProvider to launch calc.exe, plus a novel mutation-based serialization attack that turns key/value dictionaries (e.g. a "$type" key) into executable payloads. Shows techniques to bypass serialization binders via generics and contagion, and a confused-delegate binary formatter exploit using a crafted IConvertible u64 and byte[] that survives deserialize→serialize→deserialize. Recommends dropping polymorphic serializers and using safe serializers.
AI-written summary · about
chapters (12)
- 0:00Serialization vulnerabilities intro
- 1:28Security design review background
- 3:59NoSQL implicit serialization
- 9:14LightDB RCE exploit
- 11:41MongoDB & RavenDB flaws
- 14:52Mutation-based attacks discovery
- 20:10Exploitable .NET serializers
- 22:55Bypassing serialization binders
- 28:31BinaryFormatter mutation attacks
- 37:39Vendor fixes & limitations
- 40:05Preventing exploits best practices
- 42:10Q&A
related talks
24mSecond Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NET
49mDeserialization vulns: past, present, and future
35mDangerous Serialization
41mFriday the 13th: Attacking JSON
45mThe Code Behind The Vulnerability
01h 01mThe Code Behind The Vulnerability
34mDeserialization: what, how and why [not]
47mA Modern Fairy Tale: Java Serialization