iba ibaPDA / ibaDatCoordinator .NET Deserialization Remote Code Execution
A .NET deserialization vulnerability exists in iba ibaPDA and ibaDatCoordinator. An unauthenticated remote attacker can exploit it to achieve remote code execution.
The ibaPDA Server service (ibaPDAService.exe) listens on TCP port 9170 by default. Clients communicate with the server using GenuineChannels, which uses .NET Remoting. Messages sent to the server are deserialized using BinaryFormatter. GenuineChannels uses Zyan.SafeDeserializationHelpers.dll to filter BinaryFormatter payloads, but the filter only blocks a small set of gadgets (e.g., PSObject, TypeConfuseDelegate) and fails to block many other publicly known BinaryFormatter gadgets. ibaDatCoordinator uses the same vulnerable communication stack.
