Later archive addition

SerialDetector: Principled and Practical Exploration of Object Injection Vulnerabilities for the Web

Mikhail Shcherbakov and Musard Balliu · NDSS Symposium

Object injection happens when untrusted data chooses the type and properties of a deserialised object, turning existing code into a gadget chain. SerialDetector taints dataflow in .NET assemblies from public entry points to type-creating reflection APIs, matches known gadgets and confirms exploitability, finding remote code execution including three CVEs in Azure DevOps Server.

Record

Researcher

Mikhail Shcherbakov and Musard Balliu

Published by

NDSS Symposium

In the archive

• Added to the 2021 archive after the original list was published

Related sources

• Talk recording
• Talk recording

Tags

• deserialization
• gadget-chain
• rce
• dotnet
• static-analysis
• tooling
• cve
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Mikhail Shcherbakov and Musard Balliu, first published at the original source. Preserved copies are kept so the citation survives its host.