Web Hack List

Collected research

Story of my two (but actually three) RCEs in SharePoint in 2018 | Soroush Dalili (@irsdl) -- سروش دلیلی

Story of my two (but actually three) RCEs in SharePoint in 2018

SharePoint workflow protection mechanisms fell two ways: a logic flaw in the workflow checks, and deserialisation of untrusted data when compiling XOML workflow definitions. Both yield remote code execution on SharePoint Online and on-premises, and a third RCE came from deserialisation of ASP.NET .RESX resource files.

Record

Document
Story of my two (but actually three) RCEs in SharePoint in 2018
Researcher
Soroush Dalili
Published by
soroush.me
Date
Topic
Server

In the archive

Tags

This page is the archive's own catalogue record. The research is the work of Soroush Dalili, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .