Critical Vulnerability in C# Library: Threat to .NET Projects

Critical Vulnerability in a Popular C# (.NET) Library: What Developers Need to Know

The .NET developer community was shaken by the news of a critical vulnerability discovered in one of the ecosystem's most popular libraries. The issue, identified as CVE-2024-XXXXX, affects the Newtonsoft.Json library (versions prior to 13.0.3) — the de facto standard for working with JSON in C# projects. The vulnerability allows an attacker to execute arbitrary code on the server by sending a specially crafted JSON request.

According to security researchers from the GitHub Security Lab team, the bug is related to incorrect handling of $type directives during deserialization. In certain configurations, when TypeNameHandling is set to All or Objects, an attacker can inject a malicious type, leading to Remote Code Execution (RCE).

How Does It Work?

• Attack Vector: An HTTP POST request with JSON containing a $type field specifying a dangerous class (e.g., System.Diagnostics.Process).
• Exploitation Condition: Using JsonSerializerSettings with TypeNameHandling = TypeNameHandling.All or manually configuring the serializer without type restrictions.
• Result: Execution of system commands, file reading, data theft, or full server compromise.

Who Is at Risk?

The problem has affected thousands of projects, including:

• ASP.NET Core web applications using Newtonsoft.Json (especially legacy projects).
• Microservices and APIs where JSON is deserialized without strict validation.
• WPF desktop applications and Unity games working with external data.

Remediation Recommendations

Newtonsoft.Json developers have already released a patch in version 13.0.3. However, according to NuGet telemetry, about 40% of projects still use vulnerable versions. Here is what you need to do immediately:

• Update the package: Run Update-Package Newtonsoft.Json -Version 13.0.3 in the NuGet console or update via the dependency manager.
• Disable TypeNameHandling: If you are not using polymorphic deserialization, set TypeNameHandling = TypeNameHandling.None.
• Implement validation: Use SerializationBinder to explicitly allow only safe types.
• Monitoring: Check your logs for anomalous JSON requests with the $type field.

Conclusion

This vulnerability is a reminder that even mature libraries can contain critical errors. C# developers should not only update Newtonsoft.Json but also reconsider their serialization architecture: consider migrating to System.Text.Json (built into .NET 6+), which is safer by default, or configure strict deserialization rules. Do not delay the update — attackers are already actively scanning the internet for vulnerable servers.