3

I wonder whether code injection is possible for .NET-based web applications as defined by OWASP. After performing some research on .NET and code injection there is something called code injection in the context of .NET (like this) but appears unrelated to code injection against web applications.

The default example for code injection (in accord to the OWASP definition) is against PHP applications, where code is dynamically created such that it depends on user input and then executed through eval(). Is there something alike for .NET?

Improve this question
3
  • 1
    You might be surprised how powerful reflection is. See for example System.Reflection.Assembly.Load(Byte[]) which can be used to load arbitrary binary code into a process. Once loaded, it can be invoked. And of course, there's the whole infrastructure commonly used for debugging of running processes, which allows setting breakpoints, inspecting memory, modifying memory, ... and a whole bunch of other things, all very useful as attack primitives.
    – user
    Feb 9, 2017 at 12:25
  • @MichaelKjörling: I see... so similar to the situation with Java. But that means that an application developer needs to be quite reckless (up to the point of intentionally creating security holes) in order to produce a vulnerability here. (I.e. the application needs to accept and execute such bytecode.)
    – countermode
    Feb 9, 2017 at 12:40
  • 1
    Yes, but then again you could easily argue that using eval() on untrusted input is also quite reckless.
    – user
    Feb 9, 2017 at 13:41

2 Answers 2

Reset to default
2

The easiest way I can think to do code injection in .Net web application is to allow file uploads, and allow the user to upload a Razor template file (.cshtml or .vbhtml), and allow the user to request/execute it.

As mentioned in the comments, the System.Reflection is also very powerful, and could theoretically be used to inject code.

Improve this answer
-1

The general answer is yes, there are code injections in .NET.

Here are some examples:

  • SQL injections (if you use ad-hoc queries based on user input
  • XSS injections (exploiting vulnerabilities of your back-end to modify your front-end code)
  • Unauthorized file access (for example nullbyte attack or other file upload attacks)

Prevention steps often overlooked are:

  • Constrain (validate input)
  • Reject (reject known bad inputs)
  • Sanitize (beware of unsafe inputs like ' " ; ) -- / )

MSDN guide for Injections Prevention for .NET

Improve this answer
2
  • 2
    These are not examples of code injection as defined by OWASP, as stated in the question. They are related injection attacks, but this fails to answer the question that was asked.
    – Xander
    Feb 9, 2017 at 15:46
  • Exactly, SQLi, XSS and access issues are not the point of my question.
    – countermode
    Feb 9, 2017 at 22:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .