Top 10 winner

Exploiting Hardened .NET Deserialization

Piotr Bazydło · Trend Micro Zero Day Initiative

Shows how to keep exploiting .NET deserialization sinks that vendors hardened with type allow-lists and binders: new gadgets in product code and third-party libraries, arbitrary getter-call chains, and abuse of insecure serialization to reach remote code execution, arbitrary file read and environment-variable leaks, demonstrated on SolarWinds Platform and Delta InfraSuite.

Record

Researcher

Piotr Bazydło

Published by

Trend Micro Zero Day Initiative

Format

Whitepaper

In the archive

• Ranked #2 in the 2023 Top 10 Web Hacking Techniques

Related sources

• Talk recording

Tags

• deserialization
• gadget-chain
• dotnet
• filter-bypass
• rce
• info-leak
• cve
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Piotr Bazydło, first published at the original source. Preserved copies are kept so the citation survives its host.