Transformers - Dark Side of the Type - Weaponizing Conversion Layer

The talk argues that a common step, turning a plain string into an object, is a separate security problem from insecure deserialization. Many .NET programs build objects from strings through type converters, parse methods, single-argument constructors, property setters, or custom code. When an attacker can also choose the type, that conversion can run dangerous code, and no serializer is involved. The speaker names this class Insecure String Transformation.

The speaker explains which types an attacker can reach, including the global assembly cache on .NET Framework and the Windows Desktop Runtime on modern .NET. Gadgets such as ResXFileRef, XAML readers, and ObjectDataProvider show outbound network reach and code execution. Two SharePoint cases anchor the talk. A 2020 type-converter bug had no restriction in front of the sink, while a later parser bug let a generic type slip past an allow list that checked only control types. Microsoft patched both by restricting which types may be resolved.

For defenders, the hunt has three parts: find where input becomes a type, see what consumes that type, and flag gadgets that touch files, networks, or XAML. Without source code, look for .NET type names in traffic, storage, or logs. The durable fix is removing attacker control over the type, using fixed types where possible and otherwise an allow list checked before resolution.