MessagePack for C# Denial-of-Service via Insecure Defaults

Executive Summary

This vulnerability exists in MessagePack for C#, a serializer used in ASP.NET Core MVC applications. Before versions 2.5.301 and 3.1.7, the parameterless constructor of MessagePackInputFormatter used insecure default serializer options that trusted incoming data. This is problematic because the formatter processes HTTP request bodies, which come from untrusted sources. The insecure default setting can expose applications to denial-of-service attacks, such as hash-collision attacks targeting dictionary-like model properties.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to denial-of-service (DoS) attacks against your application. Attackers can exploit the insecure default serializer options to perform hash-collision attacks on dictionary-like model properties, potentially causing your application to become unresponsive or crash when processing maliciously crafted input.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade MessagePack for C# to version 2.5.301 or later, or 3.1.7 or later.

This update changes the default serializer options used by the parameterless MessagePackInputFormatter() constructor to avoid using MessagePackSecurity.TrustedData, which is insecure for ASP.NET Core MVC request bodies crossing HTTP trust boundaries.

By upgrading, you ensure that the formatter uses safer options intended to mitigate denial-of-service attacks such as hash-collision attacks.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in MessagePack for C# involves the use of insecure default serializer options that can expose applications to denial-of-service attacks. Since these attacks can affect the availability and reliability of applications handling sensitive data, this may impact compliance with standards and regulations such as GDPR and HIPAA, which require ensuring data integrity and availability.

Specifically, the vulnerability allows hash-collision attacks against dictionary-like model properties crossing HTTP trust boundaries, potentially leading to service disruption. Such disruptions could violate regulatory requirements for maintaining secure and reliable processing of personal or protected health information.

However, the provided information does not explicitly detail the direct compliance implications or mention specific standards.

Useful 0 Not Useful 0