CVE-2023-35815

Executive Summary

CVE-2023-35815 is a deserialization vulnerability in DevExpress components prior to version 23.1.3. The flaw allows an attacker to bypass data-source protection mechanisms during the deserialization of XML data. With a CVSS score of 3.5 (Low), the vulnerability is considered low severity due to the requirement for authenticated access and the limited impact on confidentiality. However, it poses a risk in environments where DevExpress is used to process untrusted XML data, potentially leading to unauthorized data access or manipulation.

Supply Chain & Package Security

DevExpress is a commercial UI component library for .NET and JavaScript platforms. This vulnerability affects the core deserialization logic within the DevExpress library. Organizations using DevExpress in their applications should treat this as a supply chain risk, as the vulnerable component is distributed via NuGet packages and other channels. The patch is available in version 23.1.3, and all users are strongly advised to update their dependencies.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)

The low severity reflects the need for an authenticated session and the limited impact. However, in contexts where DevExpress processes sensitive data, the confidentiality breach could be significant.

Deep Dive & Mechanics

The vulnerability resides in the XML deserialization routines of DevExpress. When the library deserializes XML data, it fails to properly validate the data source, allowing an attacker to craft a malicious XML payload that bypasses intended protection mechanisms. This is a classic deserialization issue (CWE-502) where untrusted data is deserialized without adequate checks.

The attack flow:

1. An authenticated user sends a specially crafted XML request to a DevExpress endpoint.
2. The DevExpress deserializer processes the XML without verifying the data source.
3. The attacker can manipulate the deserialization process to access or modify data that should be protected.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-23.1.3):

// Simplified example of vulnerable deserialization
public object DeserializeXml(string xmlData)
{
    XmlSerializer serializer = new XmlSerializer(typeof(MyData));
    using (StringReader reader = new StringReader(xmlData))
    {
        return serializer.Deserialize(reader); // No source validation
    }
}

Patched Code (23.1.3+):

// Patched version with source validation
public object DeserializeXml(string xmlData, string expectedSource)
{
    if (!ValidateSource(xmlData, expectedSource))
    {
        throw new SecurityException("Invalid data source");
    }
    XmlSerializer serializer = new XmlSerializer(typeof(MyData));
    using (StringReader reader = new StringReader(xmlData))
    {
        return serializer.Deserialize(reader);
    }
}

The patch introduces a validation step that checks the data source before deserialization, preventing the bypass.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a DevExpress application (version < 23.1.3)
• Authenticated session

Exploitation Steps:

1. Identify an endpoint that accepts XML data for deserialization.
2. Craft a malicious XML payload that exploits the missing source validation.
3. Send the payload to the endpoint.

Example Payload:

<MyData>
  <SensitiveField>malicious_value</SensitiveField>
</MyData>

Note: No public exploit code is available for this CVE. The above is a conceptual example.

Blue Team

Detection:

• Monitor for unusual XML payloads in DevExpress endpoints.
• Look for deserialization errors or exceptions in application logs.
• Use the detection rules provided below.

Hunting:

• Search for DevExpress versions < 23.1.3 in your environment.
• Review logs for XML deserialization activities.

Indicators of Compromise (IOCs)

• Network: XML payloads with unexpected structure or data source fields.
• Logs: Deserialization exceptions or security validation failures.
• System: Presence of DevExpress version < 23.1.3.

Detection Engineering

YARA Rule

rule CVE_2023_35815_DevExpress_Deserialization
{
    meta:
        description = "Detects potential exploitation of CVE-2023-35815 in DevExpress XML deserialization"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2023-35815"
    strings:
        $xml_payload = /<MyData>.*<\/MyData>/ nocase
        $devExpress_ref = "DevExpress" nocase
    condition:
        $xml_payload and $devExpress_ref
}

Sigma Rule

title: CVE-2023-35815 DevExpress Deserialization Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2023-35815 via XML deserialization
author: Valters IT
date: 2025/04/17
logsource:
    category: application
    product: devExpress
detection:
    selection:
        EventID: 1000
        Message|contains: "Deserialize"
    condition: selection
falsepositives:
    - Legitimate XML processing
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-35815 DevExpress XML Deserialization Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/deserialize"; http_uri; content:"<MyData>"; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to DevExpress version 23.1.3 or later.
2. Workaround: If immediate upgrade is not possible, restrict access to DevExpress endpoints to trusted users only.
3. Long-term: Implement input validation and sanitization for all XML data processed by DevExpress.
4. Monitoring: Enable logging for deserialization activities and review logs regularly.

Valters IT
DevSecOps & Cyber Threat Intelligence