3 ms·
The comment I replied to specifically asked about other serialization interfaces. Both that VBS, and DOC/XLS, contain some code inside. But users though they a
by Const-me 8y ago
The comment I replied to specifically asked about other serialization interfaces.
Both that VBS, and DOC/XLS, contain some code inside. But users though they are just data files, so they opened these things, running the code.
Also, old MS office files were not limited to embedded VBA. They are OLE compound files, so a specially crafted file can create and run ActiveX objects (often implemented as Win32 DLLs registered under HKEY_CLASSES_ROOT key of the registry) installed on user’s system. This is very similar to the way Java serializer creates and runs objects when desterilizing data received from untrusted source.