PoC released for CVE-2020
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1147 | XML Markup RCE in Microsoft .NET Framework, SharePoint, and Visual Studio CVE-2020-1147 is a remote code execution flaw that exists in Microsoft .NET Framework, .NET Core, SharePoint Enterprise Server, SharePoint Server, Visual Studio 2017, and Visual Studio 2019 when the software fails to check the source markup of XML file input. It is triggered when an application parses attacker-controlled XML — public proofs-of-concept demonstrate exploitation through SharePoint's DataSet/DataTable deserialization, allowing an attacker to run arbitrary code in the context of the affected application or service. An attacker who successfully exploits the flaw gains code execution with the privileges of the parsing process, which on SharePoint servers typically means compromise of a widely used business platform. Organizations running affected .NET Framework, .NET Core, SharePoint, or Visual Studio deployments are affected. Exploitation is confirmed: public PoCs were released around the July 2020 Patch Tuesday fixes, the flaw was added to CISA's Known Exploited Vulnerabilities catalog in November 2021, and news reports describe the Storm-2603 group deploying ransomware on exploited SharePoint servers. Do: Apply the July 2020 Microsoft security updates for .NET Framework, .NET Core, SharePoint, and Visual Studio, as required by CISA's KEV catalog entry. Prioritize internet-facing SharePoint servers, and hunt for signs of exploitation there given reports of Storm-2603 deploying ransomware on exploited SharePoint servers. Until patched, restrict untrusted XML input handling and limit exposure of SharePoint and other affected services to the internet. | 7.8 | 94% | KEV PoC ×4 |
| masshundreds of millions of Windows devices with .NET Framework installed, plus tens of thousands of SharePoint deployments (order of magnitude estimate) |
Full article392 words · extracted from securityaffairs.com · click to collapse
Expert release a PoC exploit code for a recently addressed critical flaw in Microsoft SharePoint, .NET Framework, and Visual Studio.
CVE-2020-1147 is a critical vulnerability in .NET Framework, SharePoint, and Visual Studio that was recently addressed by Microsoft with the release of the July 2020 Patch Tuesday security updates.
The flaw is caused by the lack of check of the source markup of XML file input, it could be exploited by an attacker to run arbitrary code in the context of the process where deserialization of XML content occurs.
“A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the process responsible for deserialization of the XML content.” reads the security advisory published by Microsoft.
Microsoft pointed out that the vulnerability is found in the DataSet and DataTable types which are .NET components that allow managing data sets.
An attacker can exploit the vulnerability by uploading a specially crafted document to a server utilizing an affected product to process content.
The CVE-2020-1147 vulnerability impacts .NET Core 2.1, .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 and 4.8 (depending on the Windows version), SharePoint Enterprise Server 2013 Service Pack 1, SharePoint Enterprise Server 2016 , SharePoint Server 2010 Service Pack 2, SharePoint Server 2019, Visual Studio 2017 version 15.9, and Visual Studio 2019 versions 16.0, 16.4 and 16.6.
Now security expert Steven Seeley published technical details of the CVE-2020-1147 flaw along with a PoC exploit that works against SharePoint servers.
for this reason, administrators are recommended to install the available patches as soon as possible.
The availability of proof-of-concept (PoC) exploit could trigger a series of attacks against SharePoint servers, Microsoft has not identified any workarounds or mitigations for this vulnerability.
“Microsoft rate this bug with an exploitability index rating of 1 and we agree, meaning you should patch this immediately if you haven’t. It is highly likley that this gadget chain can be used against several applications built with .net so even if you don’t have a SharePoint Server installed, you are still impacted by this bug.” states Seeley.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, CVE-2020-1147)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/106281/hacking/cve-2020-1147-poc-sharepoint.html