Dangerous Formatters

Vulnerable vs. safe

return soapFormatter.Deserialize(stream);

var s = new System.Runtime.Serialization.DataContractSerializer(typeof(string));

Why it matters & how to fix it

A type-permissive .NET formatter (NetDataContractSerializer, SoapFormatter, LosFormatter, or ObjectStateFormatter) is used. These embed and instantiate arbitrary CLR types from the payload, enabling deserialization RCE when the input is attacker-controlled (CWE-502). Use System.Text.Json or a DataContractSerializer bound to an explicit, known type set instead.

References

• https://cwe.mitre.org/data/definitions/502.html
• https://learn.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide

Related checks

• JavaScript / TypeScript - Insecure Deserialization
  Node Serialize Unserialize
• JavaScript / TypeScript - Insecure Deserialization
  YAML Unsafe Load
• Python - Insecure Deserialization
  Jsonpickle Decode
• Python - Insecure Deserialization
  Pickle Load
• Python - Insecure Deserialization
  YAML Unsafe Load
• Java - Insecure Deserialization
  Jackson Default Typing