Reducing Third-Party Security Risk in .NET Core Applications
summary
Demo MVC app has two concrete bugs: dynamic filename creation allowing path traversal and image URLs causing server‑side request forgery by fetching remote resources. Scans show 86% of .NET apps include at least one vulnerable third‑party component. Mitigations demonstrated: isolate the PDF library via assembly load context and self‑contained deployment, replace System.Net.Http inside the isolated folder to block outbound fetches, and run PDF generation in a separate process (named pipe or container) to prevent file‑write abuse. Quick review tool Fennec (Mono.Cecil) dumps API calls for auditing.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 3:55Dependencies
- 4:31Packages
- 5:22Statistics
- 6:47Supply Chain
- 7:42Event Stream
- 8:44Signing Packages
- 9:26Operation Shadow Hammer
- 17:38Request Forgery
- 19:22Isolation
- 19:57AB Domains
- 21:05Assembly Load Context
- 22:29Second Demo
- 23:45Interface
- 28:57Demo
- 31:39Remove dll
- 31:59Report
- 33:27Applause Script
- 34:05Exception
- 34:27Recap
- 36:07Solution
- 38:23Component vs Framework
- 39:22Intention
- 40:27Review
- 41:08Fennec
- 42:09PDF
- 44:01Method Signature
- 45:04OpenStream
- 47:09Takeaway
related talks
59mReducing Third-Party Security Risk in .NET Core Applications
58mReducing Third-Party Security Risk in .NET Core Applications
48mYour .NET App Is Probably Vulnerable Right Now
52mBuilding Community-Driven Security Analysis for Your .NET Software Supply Chain
58mASP.NET Core meets OWASP Top 10 2025
57m.NET supply chain: Protecting against hidden threats
54mASP.NET Core Meets Owasp Top 10
56m.NET supply chain: Protecting against hidden threats