Stack Overflow in MessagePack for C#

Compliance Impact

The vulnerability causes an uncatchable StackOverflowException leading to a denial-of-service condition by terminating the process when deserializing untrusted data. This disruption of service availability could impact compliance with standards and regulations that require maintaining system availability and reliability, such as GDPR and HIPAA.

However, there is no direct information provided about data confidentiality or integrity breaches, so the impact on compliance is primarily related to availability concerns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause an application using affected versions of MessagePack for C# to crash due to an uncatchable StackOverflowException.

Such crashes can lead to denial of service (DoS), where the application becomes unavailable or unstable.

Since the vulnerability does not affect confidentiality or integrity, the primary impact is availability disruption.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in MessagePack for C# versions prior to 2.5.301 and 3.1.7, specifically in the MessagePackReader.TrySkip() method. This method recursively processes nested arrays and maps without properly incrementing the reader depth or enforcing the configured depth checks.

Because of this, the protection mechanism called MessagePackSecurity.MaximumObjectGraphDepth, which is designed to prevent excessively deep object graphs, can be bypassed.

Many formatters call reader.Skip() to ignore unknown or irrelevant data for forward compatibility. If deeply nested values exist in these skipped positions, it can cause unbounded recursion leading to an uncatchable StackOverflowException.

This issue was fixed in versions 2.5.301 and 3.1.7.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade MessagePack for C# to version 2.5.301 or 3.1.7 or later, where the issue with MessagePackReader.TrySkip() has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when the MessagePack-CSharp library processes deeply nested MessagePack payloads, leading to an uncatchable StackOverflowException. Detection involves identifying if your application uses affected versions of the MessagePack-CSharp library (prior to 2.5.301 and 3.1.7) and whether it deserializes untrusted data that may contain deeply nested arrays or maps.

Since the issue manifests as a StackOverflowException during deserialization, monitoring application logs for such exceptions or unexpected crashes can help detect exploitation attempts.

There are no specific commands provided to detect this vulnerability directly on the network or system. However, you can check the installed version of the MessagePack-CSharp library in your application dependencies to determine if it is vulnerable.

• For .NET projects, use the following command to check the installed MessagePack package version: `dotnet list package | findstr MessagePack`
• Alternatively, inspect your project files (e.g., .csproj) or package manager files to verify the MessagePack-CSharp version.

To detect potential exploitation, monitor for application crashes or StackOverflowExceptions related to MessagePack deserialization.

Useful 0 Not Useful 0