Second Breakfast: Implicit & Mutation-Based Serialization Vulns in .NET
Jonathan Birch demonstrates novel .NET deserialization RCE attacks that bypass standard assumptions, exploiting database drivers and immutable data streams.
Summary
Revisiting .NET Deserialization Assumptions
Exploiting insecure deserialization in .NET traditionally assumes that an application explicitly invokes a known dangerous serializer and consumes untrusted, attacker-tampered data streams.
Violating Traditional Exploitation Prerequisites
Jonathan Birch demonstrates novel exploitation techniques where applications neither invoke standard serializers nor receive tampered serialized streams directly.
RCE Vulnerabilities in Leading Database Drivers
Case studies detail remote code execution vulnerabilities discovered in MongoDB, LiteDB, ServiceStack.Redis, RavenDB, MartenDB, JSON.Net, and the .NET JavaScriptSerializer.
Scanning Tools and Modern .NET 6+ Defenses
Birch releases automated vulnerability detection tooling and discusses defensive patterns to eliminate gadget execution in modern .NET core environments.
Related talks
Main Stage·38 min
Thomas Chauchefoin · Paul Gerste
Uncovers critical RCE vulnerabilities in Visual Studio Code, demonstrating how malicious repository configurations bypass Workspace Trust protections.
Main Stage·48 min
David Leadbeater
David Leadbeater revisits 60 years of terminal escape sequence vulnerabilities, detailing multiple remote code execution flaws across major terminal emulators.
Main Stage·37 min
good pseudonym
Dissects enterprise Private Branch Exchange (PBX) and Unified Communications platforms, chaining Java execution and PHP decryption bugs to gain root shells.