0

I have a question in regard to insecure deserialization with the JSON.Net component. It is my understanding that this component is safe by default unless you specify the TypeNameHandling setting to anything except for none.

However, suppose you do not change the TypeNameHandling setting (so that the default applies), will the following implementation be vulnerable to insecure deserialization (for instance, to achieve RCE)?

JsonConvert.DeserializeObject<dynamic>(jsonModelFromUserinput)

I'm only able to create RCE when the default TypeNameHandling setting is changed.

3
  • This answers your question stackoverflow.com/questions/49038055/… Commented Dec 22, 2020 at 9:57
  • Thank you. It helped me further. Commented Dec 22, 2020 at 10:31
  • 1
    Goodness gracious. The best part about JSON is that it's simplicity means that parsing libraries have far less to worry about when it comes to application vulnerabilities. A tool where you have to worry about RCE when decoding JSON is just stupid... Commented Dec 22, 2020 at 13:26

0

You must log in to answer this question.

Browse other questions tagged .