Researcher Demonstrates Bypasses for Hardened .NET Deserialization

Summary

Piotr Bazydło demonstrates deserialization and serialization gadget chains that bypass protections in SolarWinds, Exchange and Device Master, enabling code execution or information disclosure in test scenarios.

Key points

• The researcher bypassed a SolarWinds deserialization blocklist using a misidentified class and custom gadgets in the product codebase.
• An Exchange allowlisted generic class could invoke an unchecked inner type; a subsequent blocklist could also be bypassed with an Exchange class that starts a process.
• The Exchange vulnerabilities demonstrated could be exploited by a user with a mailbox, according to the researcher.
• In Device Master, a serialization gadget triggered binary deserialization and pre-authentication code execution after an earlier architecture change.
• SolarWinds serialization gadgets exposed file contents and database credentials; one demonstration used a recovered secret to execute commands.
• The researcher combined arbitrary getter calls with serialization gadgets and described further bypasses of class blocklists.
• Microsoft told the researcher that remote DLL loading behavior in newer .NET versions was expected and that its documentation would be changed.