Untrusted data can lead to DoS attack due to hash collisions and stack overflow in MessagePack

Learn more about best security practices when reading untrusted data with MessagePack 1.x.

MessagePack 2.x users

1. Upgrade to any 2.1.x or later version.

2. When deserializing untrusted data, put MessagePack into a more secure mode by configuring your MessagePackSerializerOptions.Security property:

   var options = MessagePackSerializerOptions.Standard
       .WithSecurity(MessagePackSecurity.UntrustedData);
   
   // Pass the options explicitly for the greatest control.
   T object = MessagePackSerializer.Deserialize<T>(data, options);
   
   // Or set the security level as the default.
   MessagePackSerializer.DefaultOptions = options;
   

3. Any code produced by mpc should be regenerated with the mpc tool with the matching (patched) version. Such generated code usually is written to a file called Generated.cs. A patched Generated.cs file will typically reference the Security member on the MessagePackSerializerOptions parameter.

   Review any custom-written IMessagePackFormatter<T> implementations in your project or that you might use from 3rd party packages to ensure they also utilize the MessagePackSecurity class as required. In particular, a formatter that deserializes an object (as opposed to a primitive value) should call options.Security.DepthStep(ref reader); before deserializing the object's members, and be sure to revert the depth step with reader.Depth--; before exiting the method. For example:

   public MyObject Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options)
   {
       if (reader.TryReadNil())
       {
           return default;
       }
       else
       {
           options.Security.DepthStep(ref reader); // STACK OVERFLOW MITIGATION, line 1
           try
           {
               MyObject o = new MyObject();
               // deserialize members of the object here.
               return o;
           }
           finally
           {
               reader.Depth--; // STACK OVERFLOW MITIGATION, line 2
           }
       }
   }
   

   If your custom formatter creates hash-based collections (e.g. Dictionary<K, V> or HashSet<T>) where the hashed key comes from the messagepack data, always instantiate your collection using options.Security.GetEqualityComparer<TKey>() as the equality comparer:

   var collection = new HashSet<T>(options.Security.GetEqualityComparer<T>());
   

   This ensures that when reading untrusted data, you will be using a collision-resistent hash algorithm.

Learn more about best security practices when reading untrusted data with MessagePack 2.x.

Workarounds

The security vulnerabilities are in the formatters. Avoiding the built-in formatters entirely in favor of reading messagepack primitive data directly or relying on carefully written custom formatters can provide a workaround.

MessagePack v1.x users may utilize the MessagePackBinary static class directly to read the data they expect. MessagePack v2.x users may utilize the MessagePackReader struct directly to read the data they expect.

References

Learn more about best security practices when reading untrusted data with MessagePack 1.x or MessagePack 2.x.

For more information

If you have any questions or comments about this advisory:

• Open an issue in MessagePack-CSharp
• Email us