CVE-2025-66631: 
C# vulnerability analysis and mitigation

CVE-2025-66631 is a remote code execution vulnerability in CSLA .NET caused by the use of the insecure NetDataContractSerializer (NDCS) within the WcfProxy component. It affects all versions of CSLA .NET prior to version 6.0.0. The vulnerability was published on December 5, 2025, by rockfordlhotka (the CSLA project maintainer) and added to the GitHub Advisory Database on December 8, 2025 (Github Advisory). It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 7.2 (High) (Github Advisory).

The root cause is insecure deserialization (CWE-502): CSLA .NET versions before 6 expose a WcfProxy data portal channel that internally uses System.Runtime.Serialization.NetDataContractSerializer (NDCS) to serialize and deserialize objects. NDCS is considered obsolete by Microsoft and is inherently insecure because it allows arbitrary .NET types to be instantiated during deserialization without type restriction, enabling an attacker to craft malicious serialized payloads that trigger code execution upon deserialization (Github Advisory, Microsoft Docs). The attack requires no authentication, no user interaction, and is reachable over the network wherever the CSLA data portal WCF endpoint is exposed. The fix, implemented in PR #4018, removed BinaryFormatterWrapper.cs and NetDataContractSerializerWrapper.cs entirely, replacing serialization with MobileFormatter (CSLA PR #4018).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the CSLA .NET data portal, resulting in full system compromise. This encompasses complete confidentiality breach (unauthorized access to sensitive business data), integrity violation (unauthorized modification of application data and system state), and availability impact (potential denial of service or system disruption) (Github Advisory). Given that CSLA .NET is a business logic framework used in enterprise .NET applications, exploitation could expose sensitive business data and enable lateral movement within internal networks.

No public proof-of-concept exploit is currently known, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.43% (per Feedly data), though the GitHub Advisory Database reports an EPSS of 2.819% (86th percentile), reflecting the theoretical risk of exploitation given the well-understood nature of NDCS deserialization attacks (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack complexity is low and requires no privileges or user interaction, but exploitation does require that the WcfProxy data portal endpoint be network-accessible.

1. Reconnaissance: Identify applications using CSLA .NET versions prior to 6.0.0 with a WCF-based data portal endpoint exposed on the network. This can be done by scanning for WCF service endpoints (e.g., via WSDL discovery or network port scanning) or by reviewing application configuration files for WcfProxy data portal settings.
2. Craft malicious payload: Using known .NET deserialization gadget chains (e.g., via tools like ysoserial.net), craft a serialized payload targeting NetDataContractSerializer. Select a gadget chain compatible with the target .NET runtime that triggers arbitrary command execution upon deserialization.
3. Deliver payload: Send the crafted serialized payload to the exposed CSLA WCF data portal endpoint over the network. No authentication credentials are required.
4. Trigger deserialization: The server-side WcfProxy passes the received data to NetDataContractSerializer.Deserialize(), which processes the malicious payload and instantiates attacker-controlled types, executing the embedded gadget chain.
5. Achieve code execution: The gadget chain executes arbitrary commands on the server under the identity of the application process, enabling reverse shell establishment, data exfiltration, or further lateral movement (Github Advisory, Microsoft Docs).

• Network: Unexpected or malformed SOAP/WCF requests to the CSLA data portal endpoint containing unusually large or binary-encoded payloads; outbound connections from the application server to unknown external IPs following data portal requests.
• Logs: WCF service trace logs showing deserialization errors or unexpected type instantiation; application event logs recording exceptions originating from System.Runtime.Serialization.NetDataContractSerializer.
• Process: Unusual child processes spawned by the .NET application worker process (e.g., cmd.exe, powershell.exe, curl, wget) with no corresponding user activity.
• File System: Unexpected new files (scripts, executables, web shells) written to the application directory or temp folders by the application process account; new scheduled tasks or services created by the application identity.

The primary remediation is to upgrade CSLA .NET to version 6.0.0 or higher, which removes all use of WCF and NetDataContractSerializer in favor of the safer MobileFormatter (Github Advisory, CSLA PR #4018). For applications that cannot immediately upgrade, the workaround is to stop using WcfProxy in the CSLA data portal configuration, which eliminates the vulnerable code path entirely. Microsoft also recommends replacing NetDataContractSerializer with a secure serializer and enabling .NET code analysis rule CA2310 to detect insecure deserializer usage (Microsoft Docs).