🔺Severity: Critical
👽 Reporter: kyotozzx
⭐️ Reputation: 351
🛠 State: resolved
💼 Team: 8x8
💵 Bounty: 3000
🕐 Submitted: 2026-07-13
⏰ Disclosed: 2026-09-01 23:51:36
📝 Summary: A deserialization vulnerability was reported in the 8x8 Connect Automation Builder's HTTP request step. The vulnerability occurred when server-side template evaluation exposed Newtonsoft JSON objects directly to the Jint JavaScript engine. By providing a specially crafted JSON response, an authenticated user could coerce Jint's overload resolution to construct a
JsonSerializer with attacker-controlled TypeNameHandling settings, enabling deserialization of arbitrary .NET types. The issue was addressed by projecting HTTP responses to plain JavaScript values before template evaluation, removing all Newtonsoft object exposure from the template scope.📂 Report JSON File: 3861550
@hackeronereports