Collected research

Re-Animating ActivitySurrogateSelector

Nick Landers · NetSPI

Microsoft's .NET 4.8 fix for the ActivitySurrogateSelector deserialization gadget is only a type check that a hidden app setting can disable. A still-working gadget, TextFormattingRunProperties driving XamlReader and ObjectDataProvider, sets that flag or writes the internal boolean by reflection, re-enabling arbitrary assembly loading and code execution from a deserialization sink.

Record

Researcher

Nick Landers

Published by

NetSPI

Topic

Other

In the archive

• Collected in the 2019 research round

Related sources

• ActivitySurrogateSelector bypass implementation

Tags

• deserialization
• gadget-chain
• rce
• dotnet
• filter-bypass
• prior-art-extension
• tooling
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Nick Landers, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 12 August 2026.