Is Your Json.Net `TypeNameHandling` Setting (Auto) Vulnerable to External JSON Data Attacks?

Can External JSON Data Pose a Threat with Json.Net TypeNameHandling Set to Auto?

In JSON deserialization, the TypeNameHandling setting of Json.Net plays a crucial role in mitigating potential threats. However, concerns remain regarding the safety of using this setting with user-provided JSON data. Let's delve into the issue and explore the potential risks and precautions.

The Vulnerabilities of TypeNameHandling

External JSON payloads can be manipulated to contain "$type" properties that specify types for deserialization. If these types are not carefully validated, attackers can exploit them to instantiate rogue objects known as "attack gadgets." These gadgets can execute malicious actions, such as remote code execution (RCE) or file system manipulation.

Protection Measures

Json.Net has implemented safeguards to prevent such attacks:

• Unknown Property Ignorance: It ignores unknown properties, rendering JSON payloads with extraneous "$type" properties harmless.
• Serialization Compatibility: During polymorphic value deserialization, it checks whether the resolved type matches the expected one. If not, an exception is thrown.

Potential Loopholes

Despite these measures, there are certain situations where an attack gadget might still be constructed, even in the absence of obvious untyped members:

• Untyped Collections: Deserializing collections of unknown types, such as ArrayList, List