CVE-2022-28684: DevExpress SafeBinaryFormatter RCE Flaw

CVE-2022-28684 Overview

CVE-2022-28684 is an insecure deserialization vulnerability affecting DevExpress installations. This vulnerability allows remote attackers to execute arbitrary code on affected systems through the SafeBinaryFormatter library. Authentication is required to exploit this vulnerability, but once authenticated, an attacker can leverage the flaw to execute code in the context of the service account.

The vulnerability exists due to the lack of proper validation of user-supplied data, which results in deserialization of untrusted data. This type of vulnerability is particularly dangerous in .NET environments where deserialization of malicious payloads can lead to complete system compromise.

Critical Impact

Authenticated attackers can achieve remote code execution in the context of the service account, potentially leading to complete system compromise.

Affected Products

• DevExpress versions prior to 21.1.8
• DevExpress versions 21.2.x prior to 21.2.5
• DevExpress versions 22.1.x including 22.1.0

Discovery Timeline

• 2022-08-03 - CVE-2022-28684 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-28684

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The flaw resides within the SafeBinaryFormatter library component of DevExpress. Despite its name suggesting secure serialization handling, the library fails to properly validate user-supplied data before deserializing it.

In .NET applications, the BinaryFormatter class is notoriously dangerous when used with untrusted input because it can instantiate arbitrary types and execute code during the deserialization process. The SafeBinaryFormatter was intended to provide a safer alternative, but this vulnerability demonstrates that the implementation contains critical weaknesses that can be exploited by authenticated attackers.

The vulnerability is network-accessible with low attack complexity. While authentication is required, no user interaction is necessary for exploitation. A successful attack impacts all three security pillars: confidentiality, integrity, and availability.

Root Cause

The root cause of CVE-2022-28684 lies in insufficient validation of serialized data within the SafeBinaryFormatter library. The component fails to adequately restrict the types that can be deserialized, allowing attackers to craft malicious serialized objects that execute arbitrary code when processed.

.NET deserialization vulnerabilities typically exploit gadget chains—sequences of existing classes in the application or framework that, when deserialized in a specific order, lead to code execution. The SafeBinaryFormatter does not implement sufficient type filtering or allowlisting to prevent such gadget chain attacks.

Attack Vector

The attack vector is network-based, requiring the attacker to first authenticate to the target system. Once authenticated, the attacker can submit specially crafted serialized data to the application. The malicious payload contains serialized objects designed to trigger code execution during the deserialization process.

An attacker would typically craft a malicious serialized object using known .NET deserialization gadgets such as ObjectDataProvider, TypeConfuseDelegate, or other chain-based payloads. When the vulnerable application deserializes this payload through the SafeBinaryFormatter, the embedded code executes in the context of the service account running the application.

For detailed technical information about this vulnerability, see the Zero Day Initiative Advisory ZDI-22-872.

Detection Methods for CVE-2022-28684

Indicators of Compromise

• Unusual process spawning from DevExpress application service accounts
• Unexpected network connections originating from applications using DevExpress components
• Suspicious serialized data payloads in application logs or network traffic containing .NET deserialization gadget class names
• Anomalous file system activity or command execution by the service account hosting DevExpress applications

Detection Strategies

• Monitor for known .NET deserialization gadget chain signatures in incoming requests to DevExpress-powered applications
• Implement application-level logging to capture deserialization events and flag unexpected type instantiation
• Deploy network intrusion detection rules to identify malicious serialized payloads targeting .NET applications
• Review authentication logs for suspicious access patterns followed by unusual application behavior

Monitoring Recommendations

• Enable detailed application logging for all DevExpress components, particularly around serialization operations
• Configure SIEM rules to correlate authentication events with subsequent anomalous process or network activity
• Monitor service account behavior for signs of compromise, including unauthorized command execution or lateral movement attempts
• Establish baselines for normal application behavior to detect deviations that may indicate exploitation

How to Mitigate CVE-2022-28684

Immediate Actions Required

• Upgrade DevExpress to version 21.1.8 or later for the 21.1.x branch
• Upgrade DevExpress to version 21.2.5 or later for the 21.2.x branch
• Upgrade DevExpress to version 22.1.1 or later for the 22.1.x branch
• Review and restrict network access to applications using DevExpress components
• Audit authentication mechanisms and enforce strong authentication controls

Patch Information

DevExpress has released patches addressing this vulnerability. Organizations should upgrade to the following minimum versions:

• Version 21.1.8 for the 21.1.x release line
• Version 21.2.5 for the 21.2.x release line
• Version 22.1.1 or later for the 22.1.x release line

Consult the Zero Day Initiative Advisory ZDI-22-872 for additional details on the vulnerability and remediation guidance.

Workarounds

• Implement network segmentation to limit access to systems running vulnerable DevExpress installations
• Apply strict input validation at the application layer before data reaches serialization components
• Run DevExpress applications with least-privilege service accounts to minimize the impact of successful exploitation
• Consider implementing Web Application Firewalls (WAF) with rules to detect and block serialized payload attacks

# Example: Restrict network access to DevExpress application ports
# Linux iptables example - restrict access to specific trusted networks
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP