Collected research

SerialDetector: Principled and Practical Exploration of Object Injection Vulnerabilities for the Web

Mikhail Shcherbakov and Musard Balliu · NDSS Symposium

Object injection happens when untrusted data chooses the type and properties of a deserialised object, turning existing code into a gadget chain. SerialDetector taints dataflow in .NET assemblies from public entry points to type-creating reflection APIs, matches known gadgets and confirms exploitability, finding remote code execution including three CVEs in Azure DevOps Server.

Record

Researcher

Mikhail Shcherbakov and Musard Balliu

Published by

NDSS Symposium

Topic

Injection

In the archive

• Collected in the 2021 research round

Related sources

• NDSS 2021 SerialDetector: Principled and Practical Exploration of Object Injection Vulnerabilities..
• NDSS 2021 SerialDetector: Principled and Practical Exploration of Object Injection Vulnerabilities..

Tags

• deserialization
• gadget-chain
• rce
• dotnet
• static-analysis
• tooling
• cve
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Mikhail Shcherbakov and Musard Balliu, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.