CVE-2023-35814

Executive Summary

CVE-2023-35814 is a deserialization vulnerability in DevExpress XtraReport, affecting ASP.NET web forms. The flaw allows an unauthenticated attacker to tamper with serialized report data, potentially leading to information disclosure or limited data manipulation. The vulnerability is rated low severity (CVSS 3.5) due to the lack of direct remote code execution, but it poses a risk in environments where report data integrity is critical. No public proof-of-concept (PoC) or exploit code is available, and the EPSS score is 0.0%, indicating low exploitation activity. The vendor has released a fix in version 23.1.3.

Supply Chain & Package Security

This vulnerability affects the DevExpress NuGet packages for ASP.NET Web Forms. Organizations using DevExpress in their supply chain should verify they are not using vulnerable versions. The package is distributed via NuGet and direct downloads from the DevExpress website.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 3.5 (Low)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The low severity reflects the limited impact: an attacker can only read or tamper with serialized report data, not execute arbitrary code or cause denial of service.

Deep Dive & Mechanics

The vulnerability resides in how DevExpress XtraReport handles serialized data in ASP.NET Web Forms. The XtraReport class uses .NET binary serialization to load report definitions. When a user submits a report request, the server deserializes the data without proper validation. An attacker can craft a malicious serialized object that, when deserialized, modifies the report's properties or extracts sensitive information embedded in the report.

The core issue is the lack of a SerializationBinder or type validation during deserialization. This allows an attacker to supply arbitrary serialized objects that the server will deserialize, potentially leading to information disclosure if the report contains sensitive data (e.g., connection strings, SQL queries, or business logic).

Vulnerable vs. Patched Code

Vulnerable Code (Pre-23.1.3):

// In a typical ASP.NET Web Forms page
protected void Page_Load(object sender, EventArgs e)
{
    string reportData = Request.Form["reportData"];
    if (!string.IsNullOrEmpty(reportData))
    {
        byte[] data = Convert.FromBase64String(reportData);
        using (MemoryStream ms = new MemoryStream(data))
        {
            // Unsafe deserialization
            XtraReport report = (XtraReport)new BinaryFormatter().Deserialize(ms);
            // Process report...
        }
    }
}

Patched Code (23.1.3+):

protected void Page_Load(object sender, EventArgs e)
{
    string reportData = Request.Form["reportData"];
    if (!string.IsNullOrEmpty(reportData))
    {
        byte[] data = Convert.FromBase64String(reportData);
        using (MemoryStream ms = new MemoryStream(data))
        {
            // Safe deserialization with type validation
            XtraReport report = XtraReport.FromStream(ms, true); // true enables safe deserialization
            // Process report...
        }
    }
}

The patch introduces a safe deserialization method (XtraReport.FromStream) that validates the types being deserialized, preventing arbitrary object instantiation.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable version of DevExpress (e.g., 23.1.2) in an ASP.NET Web Forms project.
2. Create a page that accepts serialized report data via POST.
3. Use a tool like ysoserial.net to generate a malicious payload that modifies report properties.

Exploitation Steps:

1. Intercept a legitimate report request using Burp Suite.
2. Modify the reportData parameter with a crafted serialized object that changes the report's SQL query to exfiltrate data.
3. Send the request and observe the modified report output.

Example Payload (Conceptual):

// Using ysoserial.net to generate a payload that changes report's DataSource
var payload = ysoserial.Generate("ObjectDataProvider", "System.Diagnostics.Process.Start('cmd.exe', '/c whoami > C:\\temp\\output.txt')");
string base64Payload = Convert.ToBase64String(payload);
// Send base64Payload as reportData parameter

Note: No public exploit code exists; this is a conceptual example.

Blue Team

Detection:

• Monitor for unusual base64-encoded strings in POST parameters named reportData or similar.
• Look for deserialization-related exceptions in application logs (e.g., SerializationException, InvalidCastException).
• Use network monitoring to detect large or anomalous POST requests to report endpoints.

Hunting:

• Search for BinaryFormatter.Deserialize calls in the codebase.
• Check for use of XtraReport without safe deserialization methods.
• Review IIS logs for requests with suspicious reportData parameters.

Indicators of Compromise (IOCs)

• Network: POST requests to /ReportViewer.aspx or similar endpoints with large base64-encoded reportData parameters.
• File: Temporary files created in %TEMP% with names like tmp*.report or *.xml containing serialized data.
• Logs: Application logs containing SerializationException or InvalidCastException related to XtraReport.
• Registry: No known registry IOCs.

Detection Engineering

YARA Rule

rule Detect_DevExpress_Deserialization_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2023-35814 via malicious serialized XtraReport data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-35814"
    strings:
        $s1 = "XtraReport" ascii wide nocase
        $s2 = "BinaryFormatter" ascii wide nocase
        $s3 = "reportData" ascii wide nocase
        $s4 = "ObjectDataProvider" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and $s4
}

Sigma Rule

title: CVE-2023-35814 DevExpress XtraReport Deserialization Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests with suspicious reportData parameters indicating exploitation of CVE-2023-35814
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains: '/ReportViewer.aspx'
        cs-uri-query|contains: 'reportData='
    condition: selection
falsepositives:
    - Legitimate report loading with large data
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-35814 DevExpress XtraReport Deserialization Attempt"; flow:to_server; content:"POST"; http_method; content:"/ReportViewer.aspx"; http_uri; content:"reportData="; http_client_body; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to DevExpress 23.1.3 or later.
• If upgrade is not possible, implement a custom SerializationBinder to restrict deserialized types.

Long-term:

• Replace BinaryFormatter with safer alternatives like XmlSerializer or DataContractSerializer.
• Implement input validation and size limits on report data parameters.
• Use Web Application Firewall (WAF) rules to block suspicious base64-encoded payloads.

Workaround:

• Disable report loading from user input if not required.
• Use signed or encrypted report data to prevent tampering.

Valters IT
DevSecOps & Cyber Threat Intelligence