Executive Summary

This vulnerability exists in MessagePack for C#, a serializer used in ASP.NET Core MVC applications. Before versions 2.5.301 and 3.1.7, the parameterless constructor of MessagePackInputFormatter used insecure default serializer options that trusted incoming data. This is problematic because the formatter processes HTTP request bodies, which come from untrusted sources. The insecure default setting can expose applications to denial-of-service attacks, such as hash-collision attacks targeting dictionary-like model properties.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to denial-of-service (DoS) attacks against your application. Attackers can exploit the insecure default serializer options to perform hash-collision attacks on dictionary-like model properties, potentially causing your application to become unresponsive or crash when processing maliciously crafted input.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade MessagePack for C# to version 2.5.301 or later, or 3.1.7 or later.

This update changes the default serializer options used by the parameterless MessagePackInputFormatter() constructor to avoid using MessagePackSecurity.TrustedData, which is insecure for ASP.NET Core MVC request bodies crossing HTTP trust boundaries.

By upgrading, you ensure that the formatter uses safer options intended to mitigate denial-of-service attacks such as hash-collision attacks.

Useful 0 Not Useful 0