CVE-2017-9785: Deserialization of Untrusted Data in NancyFX Nancy
Summary
CVE-2017-9785: Deserialization of Untrusted Data in NancyFX Nancy. Affects Nancy across 2 version ranges.
< 1.4.4
>= 2.0.0-alpha, < 2.0.0
Fixed in 1.4.4 or 2.0.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NancyFX Nancy is an open-source web framework for building web applications in .NET. It provides a lightweight and modular approach to web development, allowing developers to create RESTful APIs and web services. NancyFX Nancy is widely used in the .NET ecosystem and is available as a NuGet package. However, versions before 1.4.4 and 2.x before 2.0-dangermouse are vulnerable to a critical remote code execution vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2017-9785, is a result of deserialization of untrusted data in NancyFX Nancy. Specifically, the Csrf.cs file in NancyFX Nancy allows for remote code execution through the deserialization of JSON data in a CSRF Cookie. This means that an attacker can craft a malicious CSRF Cookie that, when deserialized, executes arbitrary code on the server. The impact of this vulnerability is severe, as it allows an attacker to take control of the affected server and potentially compromise sensitive data or perform unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.4.41.4.4 -
>= 2.0.0-alpha, < 2.0.02.0.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed versions mentioned above to address the issue.
Conclusion
In conclusion, the CVE-2017-9785 vulnerability in NancyFX Nancy exposes servers to remote code execution through the deserialization of untrusted data. It is crucial to update to the fixed versions mentioned above to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Nancy →
FAQ
NancyFX Nancy is an open-source web framework for building web applications in .NET. It provides a lightweight and modular approach to web development.
The vulnerability allows for remote code execution, enabling an attacker to take control of the affected server and potentially compromise sensitive data or perform unauthorized actions.
To fix this vulnerability, update NancyFX Nancy to version 1.4.4 or later for versions before 2.x, and to version 2.0.0 or later for versions 2.x.
There is no known workaround for this vulnerability. Updating to the fixed versions is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-mx3q-j2g2-5qxq/GHSA-mx3q-j2g2-5qxq.json
