Listen to this Post
The vulnerability in CSLA .NET versions prior to 6 arises from the WcfProxy data portal component using NetDataContractSerializer for deserialization. NetDataContractSerializer is an obsolete .NET serializer that includes type information in the serialized data. During deserialization, it instantiates objects based on this type information from the input stream. Attackers can craft malicious serialized payloads that embed dangerous types. When such a payload is deserialized, it can trigger the execution of arbitrary code. This is a known deserialization flaw in NetDataContractSerializer. In CSLA, WcfProxy exposes this deserialization process to remote clients. By sending a crafted message to a CSLA application configured with WcfProxy, an attacker can achieve remote code execution. The deserialization occurs without proper validation of types, allowing exploitation. This vulnerability is severe because it grants full control over the server. CSLA .NET version 6 eliminates WcfProxy and NetDataContractSerializer, removing the attack vector. For older versions, disabling WcfProxy in configuration is the workaround. The serializer’s inherent design allows code execution via gadgets in the .NET framework. Exploits often use tools like ysoserial.net to generate payloads for NetDataContractSerializer. The attack requires network access to the WcfProxy endpoint. Successful exploitation compromises the application and underlying system. This highlights the risks of using obsolete serializers in distributed applications. The vulnerability is critical in exposed services using CSLA’s WCF data portal.
Platform: CSLA .NET
Version: Prior to 6
Vulnerability: Remote Code Execution
Severity: High
Date: 5 Dec 2025
Prediction: Patched in v6
What Undercode Say:
Analytics
find . -name ".csproj" -exec grep -l "CSLA" {} \;
grep -r "WcfProxy" app.config
<add key="DataPortalProxy" value="WcfProxy"/>
ysoserial.exe -f NetDataContractSerializer -g TypeConfuseDelegate -c "calc"
how Exploit:
Craft malicious NetDataContractSerializer payload using tools. Send payload to CSLA WcfProxy endpoint. Trigger deserialization for code execution.
Protection from this CVE
Upgrade to CSLA v6. Remove WcfProxy configuration. Use alternative data portal.
Impact:
Remote code execution. Full system compromise. Application takeover.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
