CVEs-PoC/2017/CVE-2017-9424.md

CVE-2017-9424

Description

IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization.

POC

Reference

• https://www.blackhat.com/us-17/briefings.html#friday-the-13th-json-attacks
• https://www.blackhat.com/us-17/briefings.html#friday-the-13th-json-attacks

Github

• https://github.com/Y4er/dotnet-deserialization