module

Microsoft SharePoint Unsafe Control and ViewState RCE

Disclosed
May 11, 2021

Description

The EditingPageParser.VerifyControlOnSafeList method fails to properly validate user supplied data. This
can be leveraged by an attacker to leak sensitive information in rendered-preview content. This module will
leak the ViewState validation key and then use it to sign a crafted object that will trigger code execution
when deserialized.

Tested against SharePoint 2019 and SharePoint 2016, both on Windows Server 2016.
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.