Collected research

Leaking ObjRefs to Exploit HTTP .NET Remoting

Markus Wulftange · Code White

Attacking .NET Remoting over HTTP needs a valid object URI. Sending GET with a __RequestVerb: POST header reaches the formatter sink, whose catch block serialises a ReturnMessage carrying the LogicalCallContext; libraries that park a MarshalByRefObject there - DiagnosticSource via Application Insights, Datadog.Trace - hand back an ObjRef with the internal URI in the error response, and the known remoting deserialization attacks then give unauthenticated RCE. CVE-2024-29059.

Record

Researcher

Markus Wulftange

Published by

Code White

Topic

HTTP

In the archive

• Collected in the 2024 research round

Related sources

• Vulnerable app and ObjRef exploit resources

Tags

• dotnet
• deserialization
• info-leak
• rce
• aspnet
• header-injection
• cve
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Markus Wulftange, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 12 August 2026.