Critical SharePoint vulnerability identified

guest · Jul 22, 2020

Critical SharePoint flaw dissected, RCE details now available
July 22, 2020
https://www.bleepingcomputer.com/ne...int-flaw-dissected-rce-details-now-available/

Details are now available for exploiting a critical security vulnerability that affects Microsoft SharePoint, increasing the risk of attacks on unpatched systems.
Hurry up and patch
The flaw received the tracking number CVE-2020-1147 (severity 9.8 out of 10) and also impacts .NET Framework and Visual Studio. Microsoft released a fix in this month's rollout of security updates

At the heart of it, the bug is a failure to check the source markup of the XML file input, allowing an attacker to run code of their choice in the context of the process in charge of XML content deserialization.
Click to expand...

Seeley's analysis is intended to help "understand the underlying technology." It can be used to build a fully working attack script but it does not provide an exploit that can be used to deploy an attack.
Ben Hawkes, leader of Google's Project Zero security research team, argues that this issue is a greater risk than the more publicized Windows DNS wormable vulnerability.

"Empirically deserialization RCEs are way more likely to see malicious exploitation compared to memory corruption bugs that weren't exploited in the wild prior to patch" - Ben Hawkes, Google Project Zero Team Lead
Click to expand...

SharePoint and Pwn :: Remote Code Execution Against SharePoint Server Abusing DataSet

When CVE-2020-1147 was released last week I was curious as to how this vulnerability manifested and how an attacker might achieve remote code execution with it. Since I’m somewhat familar with SharePoint Server and .net, I decided to take a look.
Click to expand...

Log in or Sign up

Critical SharePoint vulnerability identified

guest Guest

Log in or Sign up

Critical SharePoint vulnerability identified

guest Guest

Useful Searches