Onderwerp: Serious Security issue with broken - Microsoft's .Net XML Serialization API

Operating Systems: All windows platform with .net framework installed

Explanation: This vulnerability could lead to serious security and
other issues depending on the
implementation. To explain this issue I will try to frame up a
possible scenario
(Am basically a programmer and can imagine a number of=20
scenarios where this issue could be a serious problem). Please let me know=
=20
if the following helps.

At the moment the best example in reference to this issue i could give=20
you is of an online shopping cart which uses .net framework (imagaine=20
amazon using .net for example).

Example:
After selecting my favorite DVD on the website I choose to checkout.=20
The checkout screen prompts me for my address and my VISA card number. I=20
type in my 15 digit VISA card number, card's expiry date and the=20
shipping address. This and the other information goes back to the server an=
d=20
code behind reads the information and maps this information to a=20
programming class such as

class UserInformation
{

string CustomerName;
string Address;=20

long VISACard;
bool VISACardCorrect; //algorithm that determines if the visa card is=20
correct

string CustomerIPAddress;
string VISACardExpiry;
}

Now imagine for security reasons Amazon would like to archive this=20
information to their log-database/repository (as most companies do - which=
=20
scares me at times) and The log archiving procedure is implemented as a=20
web service at Amazon which is over SOAP(XML).=20

The big problem: To log the customer information the code behind would=20
need to serialize the UserInformation object to XML format so it could=20
be passed to the web service. But, because of this vulnerability all=20
the information would be serialized exception for the VISA Card Number.=20
We'd be basically logging everything but the VISA Card Number which=20
might be fake and would be difficult to trace back later.

WORSE: One could be using a Fake National-ID/Passport Number/VisaCard=20
etc etc which might be "THE" essential information required but because=20
of this bug the required info is never passed to required agents.



Proof Of Concept - Compile in .net framework and essential attribute=20
value is missing in the generated xml

---Code---
using System;
using System.Xml;
using System.IO;
using System.Xml.Serialization;

namespace ConsoleApplication1
{

[Serializable()]
public class tResponseGeneralInfo
{
public long ProfileNumber;

public bool ProfileNumberSpecified;

}

class Class1
{
[STAThread]
static void Main(string[] args)
{
tResponseGeneralInfo obj =3D new
tResponseGeneralInfo();
obj.ProfileNumber =3D 23;

XmlDocument oXmlDoc =3D new XmlDocument();
oXmlDoc.Load(m_Serialize(obj));
=09=09//Print OXmlDoc's inner XML;
}

private static MemoryStream m_Serialize(object obj)
{
try
{
XmlSerializer serializer =3D new
XmlSerializer(obj.GetType());
MemoryStream ms =3D new MemoryStream();
serializer.Serialize(ms, obj);
ms.Position =3D 0;
return ms;
}
catch(Exception ex)
{

}
}
}

}=20

---

Output: Here ProfileNumber is missing

"<?xml version=3D\"1.0\"?><tResponseGeneralInfo
xmlns:xsd=3D\"http://www.w3.org/2001/XMLSchema\"xmlns:xsi=3D\"http://www.w3=
..org/2001/XMLSchema-instance\"><ProfileNumberSp
ecified>false</ProfileNumberSpecified></tResponseGeneralInfo>

---

Sorry in excitment i made some mistake in the code in case if you
haven't already figured it out

using System;
using System.Xml;
using System.IO;
using System.Xml.Serialization;

namespace ConsoleApplication1
{

[Serializable()]
public class tResponseGeneralInfo
{
public long ProfileNumber;

public bool ProfileNumberSpecified;

}

class Class1
{
[STAThread]
static void Main(string[] args)
{
tResponseGeneralInfo obj =3D new
tResponseGeneralInfo();
obj.ProfileNumber =3D 23;

XmlDocument oXmlDoc =3D new XmlDocument();
oXmlDoc.Load(m_Serialize(obj));


//Print OXmlDoc's inner XML;
System.Console.WriteLine(oXmlDoc.InnerXml);

}

private static MemoryStream m_Serialize(object obj)
{
try
{
XmlSerializer serializer =3D new
XmlSerializer(obj.GetType());
MemoryStream ms =3D new MemoryStream();
serializer.Serialize(ms, obj);
ms.Position =3D 0;
return ms;
}
catch(Exception ex)
{
return null;
}


}
}

}



thanks
rohit


On 9/13/05, Rohit <rohits79@gmail.com> wrote:
> Operating Systems: All windows platform with .net framework installed
>=20
> Explanation: This vulnerability could lead to serious security and
> other issues depending on the
> implementation. To explain this issue I will try to frame up a
> possible scenario
> (Am basically a programmer and can imagine a number of
> scenarios where this issue could be a serious problem). Please let me kno=
w
> if the following helps.
>=20
> At the moment the best example in reference to this issue i could give
> you is of an online shopping cart which uses .net framework (imagaine
> amazon using .net for example).
>=20
> Example:
> After selecting my favorite DVD on the website I choose to checkout.
> The checkout screen prompts me for my address and my VISA card number. I
> type in my 15 digit VISA card number, card's expiry date and the
> shipping address. This and the other information goes back to the server =
and
> code behind reads the information and maps this information to a
> programming class such as
>=20
> class UserInformation
> {
>=20
> string CustomerName;
> string Address;
>=20
> long VISACard;
> bool VISACardCorrect; //algorithm that determines if the visa card is
> correct
>=20
> string CustomerIPAddress;
> string VISACardExpiry;
> }
>=20
> Now imagine for security reasons Amazon would like to archive this
> information to their log-database/repository (as most companies do - whic=
h
> scares me at times) and The log archiving procedure is implemented as a
> web service at Amazon which is over SOAP(XML).
>=20
> The big problem: To log the customer information the code behind would
> need to serialize the UserInformation object to XML format so it could
> be passed to the web service. But, because of this vulnerability all
> the information would be serialized exception for the VISA Card Number.
> We'd be basically logging everything but the VISA Card Number which
> might be fake and would be difficult to trace back later.
>=20
> WORSE: One could be using a Fake National-ID/Passport Number/VisaCard
> etc etc which might be "THE" essential information required but because
> of this bug the required info is never passed to required agents.
>=20
>=20
>=20
> Proof Of Concept - Compile in .net framework and essential attribute
> value is missing in the generated xml
>=20
> ---Code---
> using System;
> using System.Xml;
> using System.IO;
> using System.Xml.Serialization;
>=20
> namespace ConsoleApplication1
> {
>=20
> [Serializable()]
> public class tResponseGeneralInfo
> {
> public long ProfileNumber;
>=20
> public bool ProfileNumberSpecified;
>=20
> }
>=20
> class Class1
> {
> [STAThread]
> static void Main(string[] args)
> {
> tResponseGeneralInfo obj =3D new
> tResponseGeneralInfo();
> obj.ProfileNumber =3D 23;
>=20
> XmlDocument oXmlDoc =3D new XmlDocument();
> oXmlDoc.Load(m_Serialize(obj));
> //Print OXmlDoc's inner XML;
> }
>=20
> private static MemoryStream m_Serialize(object obj)
> {
> try
> {
> XmlSerializer serializer =3D new
> XmlSerializer(obj.GetType());
> MemoryStream ms =3D new MemoryStream();
> serializer.Serialize(ms, obj);
> ms.Position =3D 0;
> return ms;
> }
> catch(Exception ex)
> {
>=20
> }
> }
> }
>=20
> }
>=20
> ---
>=20
> Output: Here ProfileNumber is missing
>=20
> "<?xml version=3D\"1.0\"?><tResponseGeneralInfo
> xmlns:xsd=3D\"http://www.w3.org/2001/XMLSchema\"xmlns:xsi=3D\"http://www.=
w3.org/2001/XMLSchema-instance\"><ProfileNumberSp
> ecified>false</ProfileNumberSpecified></tResponseGeneralInfo>
>=20
> ---
>