Executive Summary

This vulnerability exists in MessagePack for C#, a serializer for C#. Before versions 2.5.301 and 3.1.7, the typeless deserialization feature included a safety check to block dangerous types. However, this check only examined the outer type name and did not recursively inspect types inside arrays or generic type arguments. Consequently, a type that should have been blocked could be hidden inside an array or generic type and bypass the check, allowing the deserialization process to materialize formatters for these inner blocked types.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows potentially dangerous types to be deserialized despite safety checks, which can lead to unexpected or unsafe behavior during deserialization. This could be exploited to execute malicious code or cause application instability by bypassing type restrictions.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade MessagePack for C# to version 2.5.301 or 3.1.7 or later, where the issue with typeless deserialization and unsafe type checks has been fixed.

Useful 0 Not Useful 0