Deserialization Of Untrusted Object

2023-03-0110:14:44

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

litedb vulnerability

object deserialization

json

bsondocument

poco

bsonmapper

arbitrary code execution

EPSS

0.003

Percentile

69.9%

JSON

litedb is vulnerable to Deserialization Of Untrusted Objects. The vulnerability is caused by differing types in JSON documents, when a JSON document contains BsonDocument types, the library converts them to POCO. If an attacker can send a plain JSON string, they can inject and execute arbitrary code through the BsonMapper _type field.