CA2300: Do not use insecure deserializer BinaryFormatter

#Cause

A System.Runtime.Serialization.Formatters.Binary.BinaryFormatter deserialization method was called or referenced.

#Rule description

#author: dotpaul ms.author: paulming ms.date: 04/05/2019 ms.topic: include

Insecure deserializers are vulnerable when deserializing untrusted data. An attacker could modify the serialized data to include unexpected types to inject objects with malicious side effects. An attack against an insecure deserializer could, for example, execute commands on the underlying operating system, communicate over the network, or delete files.

This rule finds System.Runtime.Serialization.Formatters.Binary.BinaryFormatter deserialization method calls or references. If you want to deserialize only when the System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.Binder property is set to restrict types, disable this rule and enable rules CA2301 and CA2302 instead. Limiting which types can be deserialized can help mitigate against known remote code execution attacks, but your deserialization will still be vulnerable to denial of service attacks.

BinaryFormatter is insecure and can't be made secure. For more information, see the BinaryFormatter security guide.

#How to fix violations

• Use a secure serializer instead, and don't allow an attacker to specify an arbitrary type to deserialize. For more information see the Preferred alternatives.
• Make the serialized data tamper-proof. After serialization, cryptographically sign the serialized data. Before deserialization, validate the cryptographic signature. Protect the cryptographic key from being disclosed and design for key rotations.
• This option makes code vulnerable to denial of service attacks and possible remote code execution attacks in the future. For more information, see the BinaryFormatter security guide. Restrict deserialized types. Implement a custom System.Runtime.Serialization.SerializationBinder. Before deserializing, set the Binder property to an instance of your custom System.Runtime.Serialization.SerializationBinder in all code paths. In the overridden System.Runtime.Serialization.SerializationBinder.BindToType method, if the type is unexpected, throw an exception to stop deserialization.

#When to suppress warnings

BinaryFormatter is insecure and can't be made secure.

#Pseudo-code examples

#Violation

using System.IO;
using System.Runtime.Serialization.Formatters.Binary;

public class ExampleClass
{
    public object MyDeserialize(byte[] bytes)
    {
        BinaryFormatter formatter = new BinaryFormatter();
        return formatter.Deserialize(new MemoryStream(bytes));
    }
}

Imports System.IO
Imports System.Runtime.Serialization.Formatters.Binary

Public Class ExampleClass
    Public Function MyDeserialize(bytes As Byte()) As Object
        Dim formatter As BinaryFormatter = New BinaryFormatter()
        Return formatter.Deserialize(New MemoryStream(bytes))
    End Function
End Class

#Related rules

CA2301: Do not call BinaryFormatter.Deserialize without first setting BinaryFormatter.Binder

CA2302: Ensure BinaryFormatter.Binder is set before calling BinaryFormatter.Deserialize