Dynamic Code Evaluation: Serializable Delegate

A serializable Delegate field in a given class introduces an arbitrary code execution vulnerability when deserializing the class.

Delegate type is used to hold reference to a method call that can be invoked later in the user code. .NET uses custom serialization while serializing Delegate types and utilizes the System.DelegateSerializationHolder class to store the method information that are attached or subscribed to a Delegate. The serialized stream of Delegate object is not suitable for persistent storage or passing it to remote application, because if an attacker can replace the method information with one which points to a malicious object graph, the attacker will be able to run arbitrary code.

Example 1: The following class contains a serializable Delegate field and is getting invoked in the Executor method:

      ...
      [Serializable]
      class DynamicRunnner
      {
          Delegate _del;
          string[] _arg;
          public DynamicRunnner(Delegate dval, params string[] arg)
          {
              _del = dval;
              _arg = arg;
          }
          public bool Executor()
          {
              return (bool)_del.DynamicInvoke(_arg);
          }
      }
      ...
    

If the developer deserializes an untrusted stream of the class mentioned in Example 1, an attacker may replace the method information with one which points to Process.Start, causing the creation of an arbitrary process when the Executor method is called.