Description

Detects the use of unsafe .NET deserialization classes that can lead to remote code execution when processing untrusted input. Using classes like BinaryFormatter or NetDataContractSerializer to deserialize data from untrusted sources allows attackers to execute malicious code during the deserialization process.

Detection Strategy

• Check for usage of dangerous .NET deserialization classes including: BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormatter, and ObjectStateFormatter

• Report a vulnerability when any of these dangerous deserializer classes are instantiated or referenced in the code

• The entire usage of these classes is considered vulnerable since they lack built-in security controls for untrusted input

Vulnerable code example

using System.Runtime.Serialization.Formatters.Binary;
using System.Runtime.Serialization;
using System.IO;

public class UnsafeDeserialization
{
    public void ProcessData(Stream data)
    {...

✅ Secure code example

using System.Text.Json;
using System.IO;

public class SafeDeserialization
{
    public void ProcessData(Stream data)
    {
        // Safe: Using System.Text.Json which has built-in security features...