624fbe318f
## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
20 lines
2.1 KiB
Plaintext
20 lines
2.1 KiB
Plaintext
=== What is the potential impact?
|
|
|
|
When an application deserializes untrusted data without proper restrictions, an attacker can craft malicious serialized objects. Depending on the affected objects and properties, the consequences can vary.
|
|
|
|
=== Remote Code Execution
|
|
|
|
:link-with-uscores1: https://docs.microsoft.com/en-us/dotnet/api/system.codedom.compiler.tempfilecollection.-ctor?view=netframework-4.8#System_CodeDom_Compiler_TempFileCollection__ctor
|
|
|
|
If attackers can craft malicious serialized objects that contain executable code, this code will run within the application's context, potentially gaining full control over the system. This can lead to unauthorized access, data breaches, or even complete system compromise.
|
|
|
|
For example, a well-known attack vector consists in serializing an object of type ``{link-with-uscores1}[TempFileCollection]`` with arbitrary files (defined by an attacker) which will be deleted on the application deserializing this object (when the https://docs.microsoft.com/en-us/dotnet/api/system.codedom.compiler.tempfilecollection.finalize?view=netframework-4.8[finalize()] method of the TempFileCollection object is called). These kinds of specially crafted serialized objects are called "https://github.com/pwntester/ysoserial.net[gadgets]".
|
|
|
|
=== Privilege escalation
|
|
|
|
Unrestricted deserialization can also enable attackers to escalate their privileges within the application. By manipulating the serialized data, an attacker can modify object properties or bypass security checks, granting them elevated privileges that they should not have. This can result in unauthorized access to sensitive data, unauthorized actions, or even administrative control over the application.
|
|
|
|
=== Denial of Service
|
|
|
|
In some cases, an attacker can abuse the deserialization process to cause a denial of service (DoS) condition. By providing specially crafted serialized data, the attacker can trigger excessive resource consumption, leading to system instability or unresponsiveness. This can disrupt the availability of the application, impacting its functionality and causing inconvenience to users.
|