Later archive addition

Are You My Type? Breaking .NET Through Serialization

James Forshaw · Context Information Security

Forshaw analyses .NET's BinaryFormatter and shows that deserialising untrusted data reaches dangerous framework classes such as TempFileCollection, FileSystemInfo and IWbemClassObjectFreeThreaded. He bypasses remoting's Low TypeFilterLevel via System.Data.DataSet, and abuses EvidenceBase.Clone (CVE-2012-0160) and XBAP exception marshalling (CVE-2012-0161) to round-trip serialise forged delegates and escape partial trust.

Record

Researcher

James Forshaw

Published by

Context Information Security

Format

Whitepaper

In the archive

• Added to the 2012 archive after the original list was published

Related sources

• Slides
• Video

Tags

• deserialization
• dotnet
• gadget-chain
• rce
• sandbox-escape
• privilege-escalation
• cve
• owasp-a01-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of James Forshaw, first published at the original source. Preserved copies are kept so the citation survives its host.