JavascriptObjectDeserializer - question about ysoserial.net HOT 3 CLOSED

JavascriptSerializer is only vulnerable if instantiated with a type resolver:

new JavaScriptSerializer(new SimpleTypeResolver())

This is not frequent though so chances are that your target app is not vulnerable.

If its using a type resolver, the JSON you are getting should have some "__type" attributes.

Cheers

from ysoserial.net.

Hi again,

in the regular JSON Input Requests, there are "__type" attributes in the web applications response. So the webapp is definitely using a type resolver..

A regular requests has for example the following parameter:
{sP1: 2}

The response is as follows:
{"d":[{"__type":"Intergraph.Respublica.Web.Extension.RPWebIF.NameValue","[and so on]"]}

from ysoserial.net.

Then it sounds like it could be vulnerable (if using the simpleTypeResolver and not a custom type resolver that does whitelist types). Unfortunately, from a blackbox perspective there is not a lot you can do to debug the problem.

Some ideas:

• They dont have the required assemblies
• nslookup has been deleted from the server

from ysoserial.net.