# Pwn2Own Miami 2022: ICONICS GENESIS64 Arbitrary Code Execution

GENESIS64 GraphWorX64 loads project files as unsandboxed WPF XAML, letting an attacker instantiate ObjectDataProvider to launch cmd.exe and execute arbitrary code.

- Payout: unconfirmed
- Severity: high
- Program: ICONICS
- Credited: Sector 7
- Disclosed: 2022-10-17
- CVE: CVE-2022-33315
- Write-up quality: 6/10
- Original: https://sector7.computest.nl/post/2022-10-iconics-genesis64/
- Library page: https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-10-iconics-genesis64
- Tags: domain:desktop impact:rce kind:bounty platform:blog sev:high tech:dotnet technique:source-review vuln:deserialization vuln:rce

**Target:** GraphWorX64 project file (.gwx XAML) parsed by IcoWPF.dll via XamlReader
**Root cause:** Project files are WPF XAML loaded through XamlReader() with no sandboxing, so arbitrary .NET types can be instantiated during deserialization.
**Steps:**
1. Save an empty GraphWorX64 project and observe it is a WPF XAML file.
2. Craft a ResourceDictionary XAML with an ObjectDataProvider of ObjectType Diag:Process, MethodName Start, MethodParameters `cmd.exe` and `/c calc.exe`.
3. Open the crafted file in GraphWorX64; IcoWPF.dll passes it to XamlReader() and the Process is started.
**How found:** Chose GraphWorX64 at random from the installer, saved an empty project, and noticed the file was WPF XAML — a format that directly represents object instantiation, making deserialization abuse the obvious path.
**Exploitation:** Attacker delivers a malicious .gwx/XAML project file; victim opens it in GraphWorX64, XamlReader instantiates ObjectDataProvider which invokes Process.Start with cmd.exe /c calc.exe, yielding code execution in the user's context.
**Insight:** When a desktop app's project/document format is XAML (or any markup that maps to object instantiation), grep for XamlReader/XamlReader.Load and try ObjectDataProvider with Process.Start — no memory corruption needed.