Skip To Main Content
Serialization TypeConverter.allowedTypes on Muck Rack

Serialization TypeConverter.allowedTypes

Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work. Claim your profile

Get in touch with Serialization

Contact Serialization, search articles and posts on X, monitor coverage, and track replies from one place.

Learn more about Muck Rack

Actions

Share this page

Is this you?

As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile

Articles

Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707)

|
By Type destinationType, IFormat Provider formatProvider, out byte serializationData, Serialization TypeConverter.allowedTypes
| starlabs.sg
The first usage utilizes [method 4] to reconstruct the XamlReader type. To achieve this, the custom conversion method Microsoft.Exchange.Data.SerializationTypeConverter.ConvertFrom() -> DeserializeObject() is employed, which uses BinaryFormatter with a whitelist to deserialize data. If the deserialize type happens to be a System.Type, the target type would be System.UnitySerializationHolder which is also on the whitelist.
Open in Who Shared Issue with article?
See all 1 articles