CVE-2023-32571: Dynamic-linq Linq RCE Vulnerability

CVE-2023-32571 Overview

CVE-2023-32571 is a critical remote code execution vulnerability affecting Dynamic LINQ versions 1.0.7.10 through 1.2.25. This vulnerability allows attackers to execute arbitrary code and commands when untrusted input is passed to methods including Where, Select, and OrderBy. Applications that accept user-controlled input and pass it to these Dynamic LINQ methods without proper sanitization are at risk of complete system compromise.

Critical Impact

Attackers can achieve remote code execution by injecting malicious expressions through Dynamic LINQ query methods, potentially leading to complete system compromise, data exfiltration, and lateral movement within affected environments.

Affected Products

• Dynamic LINQ versions 1.0.7.10 through 1.2.25
• Applications using System.Linq.Dynamic.Core library with vulnerable versions
• .NET applications accepting user input in LINQ query expressions

Discovery Timeline

• 2023-06-22 - CVE CVE-2023-32571 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-32571

Vulnerability Analysis

This vulnerability stems from improper input validation in Dynamic LINQ's expression parsing functionality. Dynamic LINQ extends standard LINQ by allowing string-based dynamic queries, which provides flexibility but introduces significant security risks when user input is not properly sanitized. The library fails to adequately restrict the types of expressions that can be constructed from user-controlled input, allowing attackers to craft malicious expressions that result in arbitrary code execution.

The vulnerability is classified under CWE-697 (Incorrect Comparison), indicating that the underlying issue relates to improper validation or comparison logic when processing dynamic expressions. When applications pass untrusted data directly to methods like Where(), Select(), or OrderBy(), an attacker can inject expressions that instantiate arbitrary types or invoke dangerous methods.

Root Cause

The root cause of this vulnerability lies in the Dynamic LINQ library's expression parser, which does not adequately restrict the construction of potentially dangerous expression trees. The library allows the instantiation of arbitrary .NET types and invocation of methods through the dynamic expression syntax. Without proper type restrictions or expression validation, attackers can leverage this functionality to execute arbitrary code on the server.

Attack Vector

The attack is conducted remotely over the network and requires no authentication or user interaction. An attacker identifies an application endpoint that accepts user input and passes it to Dynamic LINQ query methods. By crafting a malicious expression string, the attacker can instantiate dangerous types such as System.Diagnostics.Process or invoke methods that lead to code execution. The malicious input is processed by the Dynamic LINQ parser, which constructs an expression tree and executes the attacker's payload.

For example, an attacker might target a search or filtering endpoint where user input is used to construct dynamic queries. The injected expression could spawn processes, read sensitive files, or establish reverse shells depending on the application's execution context and permissions.

Technical details and exploitation methods can be found in the NCC Group CVE-2023-32571 Analysis.

Detection Methods for CVE-2023-32571

Indicators of Compromise

• Unusual process spawning from web application worker processes (e.g., w3wp.exe, dotnet.exe)
• Unexpected network connections originating from application servers
• Log entries showing malformed or suspicious query parameters containing .NET type names or method calls
• Evidence of command execution patterns in application logs or web server access logs

Detection Strategies

• Monitor application logs for query parameters containing suspicious patterns such as type instantiation syntax or references to dangerous namespaces like System.Diagnostics
• Implement Web Application Firewall (WAF) rules to detect and block requests containing Dynamic LINQ injection patterns
• Deploy endpoint detection solutions to monitor for anomalous process creation from web application contexts
• Use static code analysis tools to identify instances where user input flows into Dynamic LINQ methods without sanitization

Monitoring Recommendations

• Enable detailed logging for all endpoints that utilize Dynamic LINQ functionality
• Configure alerts for process creation events where the parent process is a web server or application host
• Monitor for unusual file system access or network activity from application server contexts
• Implement runtime application self-protection (RASP) to detect expression injection attempts

How to Mitigate CVE-2023-32571

Immediate Actions Required

• Upgrade Dynamic LINQ (System.Linq.Dynamic.Core) to version 1.3.0 or later immediately
• Audit all code paths where user input is passed to Dynamic LINQ methods
• Implement strict input validation and allowlisting for any user-controlled query parameters
• Consider disabling or restricting Dynamic LINQ functionality until patching is complete

Patch Information

The vulnerability has been addressed in Dynamic LINQ version 1.3.0. Organizations should upgrade to this version or later to remediate the vulnerability. The patched version implements additional restrictions on the types and methods that can be accessed through dynamic expressions.

For more information about the library and updates, refer to the GitHub Dynamic LINQ Library.

Workarounds

• Avoid passing user-controlled input directly to Dynamic LINQ methods without strict validation
• Implement allowlisting of permitted column names and operations rather than accepting arbitrary expressions
• Use parameterized approaches where possible instead of dynamic string-based queries
• Apply the principle of least privilege to application service accounts to limit the impact of potential exploitation

// Safe configuration example - use allowlisting
var allowedColumns = new HashSet<string> { "Name", "Date", "Status" };
var userInput = Request.Query["sortBy"];

// Validate input against allowlist before using in Dynamic LINQ
if (allowedColumns.Contains(userInput))
{
    var result = data.AsQueryable().OrderBy(userInput);
}