CVE-2022-21167

Name of the Vulnerable Software and Affected Versions Masuit.Tools.Core versions all

Description The issue concerns Arbitrary Code Execution via the ReceiveVarData function in the SocketClient.cs component. This occurs because the socket client transmission lacks appropriate restrictions or type bindings for the BinaryFormatter, allowing a payload to be passed via user-controllable input after the connection is established.

Recommendations For all versions, consider disabling the ReceiveVarData function in the SocketClient.cs component as a temporary workaround until a patch is available. Restrict access to the SocketClient.cs component to minimize the risk of exploitation. Avoid using the BinaryFormatter without proper restrictions or type bindings in the affected component until the issue is resolved.