.NET BinaryFormatter Deserialization
Overview
BinaryFormatter and related .NET serializers are inherently insecure when used with untrusted data. Microsoft has officially deprecated BinaryFormatter in .NET 5+ due to its inability to be secured.
Gadget chains from ysoserial.net can achieve RCE through ViewState, remoting, and other attack surfaces.
Remediation
- Use
System.Text.JsonorNewtonsoft.Jsonwith schema validation - Microsoft recommends
System.Text.Jsonas the secure replacement - If migration is not possible, validate/whitelist types before deserialization