Is Automatic JSON Deserialization with Json.Net's `TypeNameHandling.Auto` Secure, Even When Limiting Deserialization to a Specific Type?

Can External JSON Be Vulnerable Due to Json.Net TypeNameHandling Auto?

Problem:

In website applications where users upload custom JSON objects, it is imperative to be aware of potential threats arising from automated JSON type deserialization. The question is whether automatic type deserialization is susceptible to vulnerabilities if the only type deserialized is a specific type (e.g., MyObject) and none of MyObject's members have the type System.Object or dynamic.

Answer:

While adhering to these conditions significantly reduces the risk, it does not guarantee complete protection. Json.Net's TypeNameHandling setting, when set to Auto, can potentially create objects based on "$type" information even when no corresponding field exists in MyObject.

Detailed Explanation:

Attacks targeting Json.Net exploit the TypeNameHandling setting to construct "attack gadgets" - objects designed to compromise the receiving system. Json.Net's protection mechanisms include ignoring unknown properties and checking for type compatibility. However, there are scenarios where an attack gadget can be constructed even without any obvious untyped members:

• Deserialization of untyped collections (e.g., ArrayList, List