MessagePack for C# Union Deserialization Depth Bypass

Detection Guidance

This vulnerability involves the MessagePack-CSharp library's dynamic union deserializers failing to enforce depth limits, which can lead to a StackOverflowException when processing deeply nested payloads with unknown union keys.

Detection on your system or network would involve monitoring for abnormal application crashes or StackOverflowExceptions related to MessagePack deserialization, especially when handling untrusted or external data.

Since the issue is specific to the DynamicUnionResolver.BuildDeserialize API and the deserialization process, direct detection commands are not provided in the available resources.

As a practical step, you can audit your application logs for exceptions or crashes related to MessagePack deserialization. For example, searching logs for 'StackOverflowException' or errors mentioning 'MessagePack' or 'DynamicUnionResolver' might help identify exploitation attempts.

• Use log search commands like: grep -i 'StackOverflowException' /var/log/app.log
• Monitor application crash reports or error logs for deserialization failures.
• Review your codebase or dependencies to check if vulnerable versions of MessagePack-CSharp (prior to 2.5.301 or 3.1.7) are in use.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in MessagePack for C#, a serializer library. Before versions 2.5.301 and 3.1.7, the runtime-generated union deserializers created by DynamicUnionResolver did not properly enforce maximum object graph depth during recursive deserialization. Specifically, they failed to call MessagePackSecurity.DepthStep(ref reader) and did not decrement reader.Depth around recursive deserialization and skip paths. As a result, union deserialization could bypass the depth checks that protect against excessively deep or recursive data structures. Additionally, when encountering unknown union keys, the deserializer would call reader.Skip() on attacker-controlled data without the necessary depth step, further bypassing protections. This flaw could allow attackers to exploit the deserialization process in ways that were not properly constrained.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to improper enforcement of maximum object graph depth during deserialization, potentially allowing an attacker to craft malicious data that causes excessive resource consumption or unexpected behavior in applications using the affected MessagePack for C# versions. This could result in denial of service or other impacts related to processing attacker-controlled data without proper depth checks.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update MessagePack for C# to version 2.5.301 or 3.1.7 or later, where the issue with runtime-generated union deserializers not enforcing maximum object graph depth has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in MessagePack for C# involves improper enforcement of maximum object graph depth during union deserialization, which could potentially allow attacker-controlled data to bypass certain security checks.

However, there is no specific information provided about how this vulnerability directly impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0