Denial of Service in MessagePack for C#

Compliance Impact

This vulnerability primarily impacts system availability by causing CPU exhaustion and excessive memory allocation, potentially making a server unresponsive or crashing under concurrent load.

While the CVE description and resources do not explicitly mention compliance with standards like GDPR or HIPAA, disruptions in system availability could indirectly affect compliance by impacting the availability and reliability of systems that handle sensitive data.

Mitigations such as upgrading to patched versions, avoiding deserialization of untrusted payloads into ExpandoObject, and enforcing request-size limits can help maintain system stability and thus support compliance efforts.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in MessagePack for C#, specifically in versions prior to 2.5.301 and 3.1.7. The ExpandoObjectFormatter.Deserialize method populates a System.Dynamic.ExpandoObject by adding each map entry using IDictionary<string, object>.Add. Internally, ExpandoObject maintains member names in array-like structures, so inserting many distinct keys causes repeated linear scans and array copies. When processing large attacker-controlled maps, this results in quadratic CPU and memory allocation behavior, leading to performance degradation.

The issue is notable because even though ExpandoObjectResolver.Options is configured with MessagePackSecurity.UntrustedData, which uses collision-resistant dictionary comparers, these cannot protect against the internal insertion inefficiencies of ExpandoObject.

This vulnerability was fixed in versions 2.5.301 and 3.1.7 of MessagePack for C#.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to significant performance degradation when deserializing large attacker-controlled maps using MessagePack for C#. The quadratic CPU and memory allocation behavior can cause excessive resource consumption, potentially leading to denial of service (DoS) conditions where the application becomes slow or unresponsive.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update MessagePack for C# to version 2.5.301 or later, or 3.1.7 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusually high CPU usage or memory allocation spikes during deserialization of MessagePack payloads, especially when processing large maps with many distinct keys into ExpandoObject.

Since the issue arises from deserializing attacker-controlled large maps, detection can involve inspecting network traffic for large MessagePack payloads containing many distinct keys.

Suggested commands include using network packet inspection tools like tcpdump or Wireshark to capture MessagePack traffic, and then analyzing payload sizes and map entry counts.

• Use tcpdump to capture traffic on the relevant port: tcpdump -i <interface> port <port_number> -w capture.pcap
• Analyze captured packets with Wireshark or a custom script to identify large MessagePack maps with many keys.
• Monitor system CPU and memory usage with commands like top, htop, or Windows Task Manager during deserialization operations.
• If you have access to application logs or telemetry, look for deserialization errors or performance degradation correlated with large or complex MessagePack payloads.

Useful 0 Not Useful 0