Exploitation of a critical Remote Code Execution (RCE) vulnerability in SharePoint was achieved through a harmful XML payload within a web part.

Exploitation of a critical Remote Code Execution (RCE) vulnerability in SharePoint was achieved through a harmful XML payload within a web part.

A critical Remote Code Execution (RCE) vulnerability has been identified in Microsoft SharePoint version 15.0.5145.1000. This security flaw stems from an unsafe deserialization issue in the SPObjectStateFormatter class, which is used during the parsing of WebPart properties[1][2].

An authenticated attacker can exploit this vulnerability by inserting malicious XML or HTML content into WebPart controls, leading to arbitrary code execution on the SharePoint server.

To protect SharePoint environments against this RCE vulnerability, it is recommended to:

1. Apply Microsoft security patches immediately: Microsoft has already released patches addressing this vulnerability. Ensuring SharePoint 15.0.5145.1000 instances are fully updated with these patches is the primary and most effective defense[1].

2. Restrict permissions and access: Since the exploit requires an authenticated user, limit user permissions to only what is necessary. Apply the principle of least privilege, especially for users with rights to add or modify WebParts.

3. Validate and sanitize WebPart input: Implement strict validation and filtering of any XML or HTML data that can be added to WebParts, blocking any unexpected or suspicious content before it is processed.

4. Monitor and audit WebPart changes: Regularly audit changes to WebPart configurations and content to detect any unauthorized or abnormal modifications.

5. Disable or restrict usage of vulnerable WebParts: If possible, disable or restrict the use of WebParts (such as XmlWebPart) that rely on the vulnerable deserialization mechanism until patches are verified and applied[1].

6. Harden the SharePoint environment: Follow general SharePoint security best practices like network segmentation, application whitelisting, and ensuring proper firewall rules to protect the server from unauthorized access.

7. Educate users and administrators: Raise awareness about the risks of malicious content insertion and the need for prompt patching and safe operational procedures.

The vulnerability lies in the GetAttachedProperties() method where SharePoint deserializes the _serializedAttachedPropertiesShared field using the SPSerializationBinder. The exploitation process involves the XmlSerializer and subsequently triggers the DoPostDeserializationTasks() method, creating a pathway for malicious code execution.

This vulnerability underscores the critical importance of secure deserialization practices in enterprise applications and the need for comprehensive security reviews of complex application frameworks like SharePoint. Organizations should immediately apply the latest SharePoint security updates and implement strict input validation for WebPart content to prevent potential exploitation.

Network segmentation and monitoring of SharePoint web service endpoints, particularly the /_vti_bin/webpartpages.asmx endpoint with the ConvertWebPartFormat method, can help detect potential exploitation attempts.

Sources: [1] Microsoft Security Advisory (CVE-2021-30504): [2] TechCommunity: SharePoint Remote Code Execution Vulnerability CVE-2021-30504:

To ensure the security of data-and-cloud-computing systems using SharePoint, it is crucial to promptly apply Microsoft's security patches addressing the identified RCE vulnerability (Microsoft Security Advisory CVE-2021-30504). Furthermore, implementing strict input validation for WebPart content can help prevent potential exploitation of this cybersecurity threat.

Read also: