MessagePack-CSharp Typeless Deserialization Type Confusion

Executive Summary

This vulnerability exists in MessagePack for C#, a serializer for C#. Before versions 2.5.301 and 3.1.7, the typeless deserialization feature included a safety check to block dangerous types. However, this check only examined the outer type name and did not recursively inspect types inside arrays or generic type arguments. Consequently, a type that should have been blocked could be hidden inside an array or generic type and bypass the check, allowing the deserialization process to materialize formatters for these inner blocked types.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows potentially dangerous types to be deserialized despite safety checks, which can lead to unexpected or unsafe behavior during deserialization. This could be exploited to execute malicious code or cause application instability by bypassing type restrictions.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade MessagePack for C# to version 2.5.301 or 3.1.7 or later, where the issue with typeless deserialization and unsafe type checks has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability in MessagePack-CSharp's typeless deserialization can allow attackers to bypass type restrictions and instantiate blocked types during deserialization. Such behavior may lead to the processing of untrusted or malicious data, potentially causing unauthorized actions or data exposure.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, vulnerabilities that allow unsafe deserialization and potential data manipulation or exposure can negatively impact compliance with these regulations, which require protection of sensitive data and secure processing.

Therefore, organizations using affected versions of MessagePack-CSharp without applying patches or mitigations might face increased risk of non-compliance due to potential data integrity and security issues.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects applications using MessagePack-CSharp's typeless deserialization feature, specifically when using untrusted payloads with methods like MessagePackSerializer.Typeless or TypelessObjectResolver.

To detect this vulnerability on your system, you should first identify if your application uses vulnerable versions of MessagePack-CSharp (prior to 2.5.301 and 3.1.7) and if it employs typeless deserialization.

There are no specific network detection commands provided in the resources. However, you can check the installed MessagePack-CSharp package version in your project dependencies.

• For .NET projects using NuGet, run: dotnet list package | findstr MessagePack
• Alternatively, inspect your project files (e.g., .csproj) for the MessagePack package version.

To detect exploit attempts on the network, monitor for suspicious deserialization payloads targeting typeless deserialization endpoints, but no specific command or signature is provided.

The recommended mitigation is to upgrade MessagePack-CSharp to version 2.5.301 or 3.1.7 or later, or avoid typeless deserialization with untrusted data.

Useful 0 Not Useful 0