In September 2023, Microsoft announced a series of critical vulnerabilities as part of their Patch Tuesday updates. One of the most significant was CVE-2023-36788 — a Remote Code Execution (RCE) vulnerability in the .NET Framework. If you use applications built on .NET Framework, this vulnerability could let hackers run any code they want on your computers if left unpatched. This long-read post breaks down how CVE-2023-36788 works, what makes it dangerous, and how you can safeguard your systems.

What is CVE-2023-36788?

CVE-2023-36788 is a high-severity vulnerability found in versions of the .NET Framework prior to the posted security updates. This vulnerability allows an attacker to remotely execute code on an affected machine — potentially leading to data theft, system manipulation, or complete takeover.

Microsoft's official CVE page:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36788

Here’s how Microsoft describes it

> "An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user."

How Does CVE-2023-36788 Work?

At its core, this vulnerability occurs because certain .NET Framework features do not properly handle object deserialization. Deserialization is when a program takes structured data (like a saved configuration) and turns it back into an object in memory. If handling is insecure, an attacker can force an application to load specially crafted data, causing it to execute harmful instructions.

Let’s break down the process

1. Attacker crafts a malicious payload: This could be a file or a network message designed to exploit the way .NET deserializes data.
2. Victim opens/loads the payload: Perhaps by opening a file in a .NET-based application or browsing to a malicious website.
3. RCE triggered: The application attempts deserialization, runs the attacker’s code, and the attacker gains control.

Here’s a small (unsafe!) .NET code snippet that demonstrates insecure deserialization

using System;
using System.IO;
using System.Runtime.Serialization.Formatters.Binary;

public class VulnerableApp
{
    public static void Main(string[] args)
    {
        string filePath = args[]; // File path from user input
        object obj;
        using (FileStream fs = new FileStream(filePath, FileMode.Open))
        {
            BinaryFormatter formatter = new BinaryFormatter();
            obj = formatter.Deserialize(fs); // Vulnerable: deserializing untrusted input!
        }
        Console.WriteLine("Object deserialized: " + obj.ToString());
    }
}

Never deserialize untrusted data!
Attackers can create special files that, when deserialized, trigger their own code.

Realistic Attack Scenario

1. Phishing Email: The attacker sends a file attachment to an employee at a company, knowing their internal app uses .NET and unserializes unknown files.

File Execution: The employee opens the file using the vulnerable application.

3. Compromise: The attacker’s code is executed, possibly dropping ransomware or stealing credentials.

There is no public Metasploit module or proof-of-concept in wide circulation, but tools like ysoserial.net can generate payloads for .NET binary formatter deserialization bugs, showing the risk is real and understood in the security community.

How to Protect Yourself

Microsoft released patches for all supported versions of .NET Framework. Installing the latest security updates is the best defense.

- Microsoft Security Update Guide: CVE-2023-36788

Never deserialize data from untrusted sources.

- Use secure serialization formats, like System.Text.Json, which do not allow code execution during deserialization.

Quick FAQ

Which .NET versions are affected?
Mostly older .NET Framework versions up to the release of the September 2023 patch. .NET Core and .NET 5+ use different (safer) serialization libraries.

Is there a patch?
Yes! Microsoft’s security updates resolve this vulnerability.

Is there an exploit in the wild?
As of now, no known public exploit, but the pattern is well-known and easily weaponized.

Key References

- Microsoft CVE-2023-36788
- Microsoft .NET Security Guidance
- OWASP: Deserialization of Untrusted Data
- ysoserial.net GitHub Tool

Final Thoughts

CVE-2023-36788 highlights the importance of secure coding practices for serialization, especially in enterprise environments that depend on .NET Framework. Keep your systems updated, review your codebase, and always validate your inputs. Ignoring these simple steps can hand your attackers the keys to your kingdom.

Timeline

Published on: 09/12/2023 17:15:00 UTC
Last modified on: 09/12/2023 19:38:00 UTC