Fix - CWE - 502 Deserialization of Untrusted Data Fix For C#

TScaria621837 (Community Member) asked a question.

August 10, 2021 at 1:45 PM

Hi everybody,

I got flaws (Deserialization of Untrusted Data (CWE ID 502)) flaw in the application. We are using LosFormatter method. This is code snippet like below -

LosFormatter formatter = new LosFormatter();

return (GridSettingsCollection)formatter.Deserialize(data);

Please suggest how to resolve these?

Thanks,

Jaisa

How To Fix Flaws

Florian, Security Consultant (Veracode)
5 years ago
Hi @TScaria621837 (Community Member) ,

We would always recommend against deserializing potentially untrusted data. But if required, please prefer formats such as JSON or Protocol Buffers as they are less vulnerable and risky options.

The LosFormatter is, as stated by Microsoft's Documentation, insecure and can't be made secure. Using tools like ysoserial makes it pretty straightforward to come up with malicious deserialization payloads and might allow an attacker to obtain Remote Code Execution on the vulnerable machine. Please explore avoiding deserialization of data coming from outside the application.

Thank you,
Florian Walter
Expand Post