Are there any known breaches of the .NET AppDomain isolation?

Question

.NET AppDomains provide several levels of isolation for untrusted or partially trusted code. The AppDomain sandbox is widely deployed in ASP.NET and Silverlight, although only the latter of these is designed to isolate completely untrusted code from the rest of the OS.

Have there been any known escapes of AppDomain-based sandboxes? I was unable to find any security advisories related to this in a cursory search. Of course this doesn't mean the sandbox is secure; it could simply be little-used. But it's a start.

I'm asking because the documentation from MSDN as to whether the sandbox is to be relied on appears to be contradictory. There's this page which states "we advise against loading and executing code of unknown origins without putting alternative security measures in place". And then there's this article whose entire title is "How to Safely Host Untrusted Add-Ins".

Answer 1

Yes, there are plenty of examples.

MS14-072 is one of the most direct ones. An attacker could hijack a remoting call to elevate privileges to other AppDomains running within the same execution context. Pretty much all the direct code execution bugs work as examples too, because once you escape the type-safe environment, you can make direct API calls on the system which violates all safety guarantees.

There are also application-level bugs which can violate the AppDomain restrictions. For example, an arbitrary file write bug could cause a secondary AppDomain to load a DLL or other executable object, leading to a compromise of both parts of the application.

As far as hosting untrusted code goes, keep in mind that the latter article you linked is very old. It is now generally considered insecure to host any kind of untrusted code. Code Access Security (CAS) has become deprecated in .NET due to its ineffectiveness and difficulty of implementation. Microsoft provides advice should you absolutely need to host untrusted code, but generally this is more focused upon using closed-source 3rd party libraries for which you have no security metrics, rather than "please upload a .NET executable and I will run it".