CWE-502: Deserialization of Untrusted Data

[edcararo]

We have recently been scanned for security vulnerabilities and the report came back with CWE-502: Deserialization of Untrusted Data.
I couldn't find anything in the forum on how csla.net was handling this .net vulnerability.
We've already implemented a white list approach to mitigate the problem, but the security firm was still able to penetrate mocking a type used by our program.
Have anybody dealt with this problem before? What approaches have you done?
Thanks

[BlagoCuljak]

Do you use Binary or Mobile formatter? And CSLA version?

https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide

[edcararo]

The version is old csla 3.5.1 and the webserviceportal uses BinaryFormatter. In the past, when we tried to upgrade to newer versions of Csla, the breakage was too intense, hence we left alone since everything was working properly.

…

On Fri, Aug 28, 2020 at 3:04 PM BlagoCuljak ***@***.***> wrote: Do you use Binary or Mobile formater? And CSLA version? https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1791 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ALZASULGYRY6WMP4O47H5P3SC75UBANCNFSM4QONIQNA> .

[BlagoCuljak]

Sometimes paying tehnological debt is huge task, and dealing with debt, can break entire project.

We spent 3 months in first corona wave, Mar-Jun, paying all sort of debt.

With good planning and some consultant work, maybe from Marimer, you should be able to upgrade. It's not going to get any better with time...

[rockfordlhotka]

Although CSLA still supports the BinaryFormatter, I generally recommend using MobileFormatter. Partly because Microsoft recommends against BinaryFormatter for external data transfer (or any transfer really), and party because we've worked hard to optimize MobileFormatter for CSLA and I think, in most cases, it does a better job.