Deserialization of Untrusted Data

Property
Language	csharp
Severity
CWE	CWE-502: Deserialization of Untrusted Data
OWASP	A08:2017 - Insecure Deserialization
Confidence Level	Low
Impact Level	High
Likelihood Level	Low

Description#

Implementing a custom DataContractResolver can be risky if you are not fully controlling what data types are being deserialized. Allowing untrusted or unknown types can let attackers supply malicious objects that trigger unexpected behavior during deserialization.

Impact#

If exploited, an attacker could inject specially crafted data that leads to remote code execution, data tampering, or denial of service. This can compromise application integrity, expose sensitive information, and potentially allow full system compromise.