CVE-2021-29508

Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so allowing the serializer to create any type on the deserializing end. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300?view=vs-2019. This also applies to the fork of Wire.

CVSS v3 9.1 CRITICAL
CVSS v2.0 6.4 MEDIUM

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/AsynkronIT/Wire/security/advisories/GHSA-hpw7-3vq3-mmv6	Exploit Third Party Advisory
https://www.nuget.org/packages/Wire/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:asynkron:wire:*:*:*:*:*:*:*:*

History

25 May 2021, 20:39

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 6.4 v3 : 9.1
CPE		cpe:2.3:a:asynkron:wire::::::::
References	~~(CONFIRM) https://github.com/AsynkronIT/Wire/security/advisories/GHSA-hpw7-3vq3-mmv6 -~~	(CONFIRM) https://github.com/AsynkronIT/Wire/security/advisories/GHSA-hpw7-3vq3-mmv6 - Exploit, Third Party Advisory
References	~~(MISC) https://www.nuget.org/packages/Wire/ -~~	(MISC) https://www.nuget.org/packages/Wire/ - Third Party Advisory

11 May 2021, 17:24

Type	Values Removed	Values Added
CWE		CWE-502

11 May 2021, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-05-11 17:15

Updated : 2023-12-10 13:55

NVD link : CVE-2021-29508

Mitre link : CVE-2021-29508

CVE.ORG link : CVE-2021-29508

JSON object : View

Products Affected

asynkron

wire

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2021-29508", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2021-05-11T17:15:07.570", "references": [{"url": "https://github.com/AsynkronIT/Wire/security/advisories/GHSA-hpw7-3vq3-mmv6", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.nuget.org/packages/Wire/", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so allowing the serializer to create any type on the deserializing end. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300?view=vs-2019. This also applies to the fork of Wire."}, {"lang": "es", "value": "Debido a la forma en que Wire maneja la informaci\u00f3n de tipo en su formato de serializaci\u00f3n, las cargas \u00fatiles maliciosas pueden ser pasadas a un deserializador. por ejemplo, utilizando un sustituto en el extremo del remitente, un atacante puede pasar informaci\u00f3n sobre un tipo diferente para el extremo receptor. Y al hacerlo, permite que el serializador cree cualquier tipo en el extremo de deserializaci\u00f3n. Este es el mismo problema que se presenta para .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300?view=vs-2019. Esto tambi\u00e9n se aplica a la bifurcaci\u00f3n de Wire"}], "lastModified": "2021-05-25T20:39:19.567", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:asynkron:wire:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E185ECD6-A2B5-4155-9EBE-4FD73AB6D933"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}