.NET BinaryFormatter Deserialization

Detects use of BinaryFormatter, SoapFormatter, and NetDataContractSerializer which are insecure for untrusted data.

zakirkun a96df10 2 files · 2.7 KB Updated

File contents

.NET BinaryFormatter Deserialization

Overview

BinaryFormatter and related .NET serializers are inherently insecure when used with untrusted data. Microsoft has officially deprecated BinaryFormatter in .NET 5+ due to its inability to be secured.

Gadget chains from ysoserial.net can achieve RCE through ViewState, remoting, and other attack surfaces.

Remediation

  • Use System.Text.Json or Newtonsoft.Json with schema validation
  • Microsoft recommends System.Text.Json as the secure replacement
  • If migration is not possible, validate/whitelist types before deserialization

zakirkun/ice-tea/tree/main/skills/deserialization/dotnet-binaryformatter commit a96df10870

Frequently asked questions

npx skillmds@latest add zakirkun/net-binaryformatter-deserialization