Security of C# Applications: Top 10 Vulnerabilities for Beginners

Security of C# Applications: Top 10 Vulnerabilities for Beginners

Software security is one of the key tasks for a developer. Even a small C# application can become a target for attackers if common vulnerabilities are not taken into account. In this article, we will cover the 10 most dangerous vulnerabilities of C# (.NET) that beginner developers encounter. You will learn how they arise, how they are exploited, and, most importantly, how to protect against them.

1. SQL Injection

This is one of the oldest and most dangerous vulnerabilities. It occurs when user input is directly concatenated into an SQL query.

Example of vulnerable code:

string userName = Request.QueryString["user"];string query = "SELECT * FROM Users WHERE Name = '" + userName + "'";SqlCommand cmd = new SqlCommand(query, connection);

How it is attacked: An attacker can pass the value ' OR 1=1 -- into the user parameter, which will return all records from the table.

Protection: Use parameterized queries.

string query = "SELECT * FROM Users WHERE Name = @userName";SqlCommand cmd = new SqlCommand(query, connection);cmd.Parameters.AddWithValue("@userName", userName);

2. Cross-Site Scripting (XSS)

The XSS vulnerability allows injecting malicious JavaScript code into a page that is displayed to other users.

Example of vulnerable code (ASP.NET WebForms):

string comment = Request.Form["comment"];Response.Write("<div>" + comment + "</div>");

Protection: Always encode output. Use HttpUtility.HtmlEncode() or Razor syntax (@), which automatically encodes data.

Response.Write("<div>" + HttpUtility.HtmlEncode(comment) + "</div>");

3. Insecure Deserialization

When deserializing data from an untrusted source (e.g., from a request or file), an attacker can execute arbitrary code on the server.

Example of vulnerable code (BinaryFormatter):

BinaryFormatter formatter = new BinaryFormatter();using (var stream = new MemoryStream(data)){    var obj = formatter.Deserialize(stream); // DANGEROUS!}

Protection: Use modern serializers (JSON, XML with restrictions), validate types, and never deserialize data from untrusted clients. Avoid BinaryFormatter, SoapFormatter, and LosFormatter.

4. Authentication and Session Management Flaws

This includes weak passwords, lack of login attempt limits, and unprotected session cookies.

Example of vulnerability: Session cookies without HttpOnly and Secure flags.

Protection:

• Use Identity or ASP.NET Core Identity.
• Configure cookies: HttpOnly, Secure, SameSite=Strict.
• Enable login attempt limits (Account Lockout).
• Use HTTPS.

services.ConfigureApplicationCookie(options =>{    options.Cookie.HttpOnly = true;    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;    options.Cookie.SameSite = SameSiteMode.Strict;});

5. Cross-Site Request Forgery (CSRF)

An attack where an attacker tricks an authenticated user into performing an unwanted action on the site (e.g., transferring money).

Protection: Use Anti-Forgery Tokens. In ASP.NET Core, this is done automatically when using the <form> tag with asp-antiforgery.