Transparency attributes in the .NET Framework, designed to protect security-critical operations, can lead to ambiguities and vulnerabilities when declared at different levels such as both for the class and a method.
Transparency attributes can be declared at several levels. If two different attributes are declared at two different levels, the attribute that
prevails is the one in the highest level. For example, you can declare that a class is SecuritySafeCritical and that a method of this
class is SecurityCritical. In this case, the method will be SecuritySafeCritical and the SecurityCritical
attribute attached to it is ignored.
Below are some real-world scenarios that illustrate some impacts of an attacker exploiting the vulnerability.
An attacker could potentially exploit conflicting transparency attributes to perform actions with higher privileges than intended.
If a member with conflicting attributes is involved in handling sensitive data, an attacker could exploit the vulnerability to gain unauthorized access to this data. This could lead to breaches of confidentiality and potential data loss.
using System;
using System.Security;
namespace MyLibrary
{
[SecuritySafeCritical]
public class Foo
{
[SecurityCritical] // Noncompliant
public void Bar()
{
}
}
}
using System;
using System.Security;
namespace MyLibrary
{
public class Foo
{
[SecurityCritical]
public void Bar()
{
}
}
}
A class should never have class-level annotations if some functions have different permission levels. Instead, make sure every function has its own correct annotation.
If no function needs a particularly distinct security annotation in a class, just set a class-level [SecurityCritical].