Description

EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-30T09:17:13.343Z",
  "pubdate": "2026-09-30T09:17:13.343Z",
  "executiveSummary": "EasyFlow .NET, developed by Digiwin, is susceptible to an insecure deserialization vulnerability. This critical security flaw enables unauthenticated remote attackers to execute arbitrary code on the underlying server. By transmitting maliciously crafted serialized objects, an attacker can bypass standard application logic and gain unauthorized control over the server environment. The vulnerability represents a high-risk scenario as it requires no prior authentication, facilitating easy exploitation by remote actors. Successful execution of this exploit leads to full system compromise, allowing for data exfiltration, service disruption, and persistent unauthorized access. The lack of proper validation during the deserialization process in the .NET framework environment within EasyFlow .NET is the primary catalyst for this security failure, necessitating immediate remediation to prevent potential exploitation.",
  "technicalDetails": "The vulnerability originates from the improper handling of serialized data streams within the Digiwin EasyFlow .NET application. The application utilizes .NET serialization mechanisms to process user-supplied input without implementing adequate validation or type checking. In .NET environments, insecure deserialization occurs when the application reconstructs object graphs from untrusted sources using vulnerable formatters, such as BinaryFormatter, NetDataContractSerializer, or LosFormatter, which can be manipulated to instantiate unintended objects.\nThe attack flow begins with the adversary crafting a malicious serialized payload. This payload is designed to leverage existing 'gadget chains'—a sequence of class constructors, finalizers, or property setters already present in the application's environment or its associated dependencies. When the EasyFlow .NET server receives this serialized content, the deserialization process automatically triggers these gadgets upon object reconstruction.\nSpecifically, the process involves the following steps: First, the attacker identifies an endpoint or service within EasyFlow .NET that accepts serialized data as part of its input handling. Second, the attacker encodes a malicious serialized object that, upon instantiation, executes arbitrary system commands or arbitrary code via methods like System.Diagnostics.Process.Start or similar execution primitives. Third, the attacker delivers this payload via HTTP POST requests or other transport protocols utilized by the application. Fourth, the server-side deserialization routine interprets the malicious object, leading to the execution of the embedded exploit logic with the privileges of the service account running the EasyFlow .NET application.\nThis vulnerability is particularly severe because the execution occurs during the object reconstruction phase, often before the application-level logic has the opportunity to perform access control checks. Consequently, the attacker achieves Remote Code Execution (RCE) without needing valid credentials or elevated privileges. Because the exploit is delivered over the network, it is accessible to any remote attacker capable of reaching the EasyFlow .NET server instance. Post-exploitation, an attacker can deploy web shells, install backdoors, move laterally within the network, or compromise sensitive data stored within the Digiwin application ecosystem."
}