.NET BinaryFormatter Deserialization

Detects use of BinaryFormatter, SoapFormatter, and NetDataContractSerializer which are insecure for untrusted data.

zakirkun Updated

File contents

.NET BinaryFormatter Deserialization

Overview

BinaryFormatter and related .NET serializers are inherently insecure when used with untrusted data. Microsoft has officially deprecated BinaryFormatter in .NET 5+ due to its inability to be secured.

Gadget chains from ysoserial.net can achieve RCE through ViewState, remoting, and other attack surfaces.

Remediation

  • Use System.Text.Json or Newtonsoft.Json with schema validation
  • Microsoft recommends System.Text.Json as the secure replacement
  • If migration is not possible, validate/whitelist types before deserialization

zakirkun/ice-tea/tree/main/skills/deserialization/dotnet-binaryformatter commit a96df10870

Frequently asked questions

npx skillmds@latest add zakirkun/net-binaryformatter-deserialization