Other nomination

Story of my two (but actually three) RCEs in SharePoint in 2018 | Soroush Dalili (@irsdl) -- سروش دلیلی

Soroush Dalili · 19 December 2018

SharePoint workflow protection mechanisms fell two ways: a logic flaw in the workflow checks, and deserialisation of untrusted data when compiling XOML workflow definitions. Both yield remote code execution on SharePoint Online and on-premises, and a third RCE came from deserialisation of ASP.NET .RESX resource files.

Record

Researcher

Soroush Dalili

Date

19 December 2018

In the archive

• Nominated for the 2018 Top 10 Web Hacking Techniques

Tags

• deserialization
• gadget-chain
• rce
• aspnet
• dotnet
• cve
• vendor-advisory
• bug-bounty
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Soroush Dalili, first published at the original source. Preserved copies are kept so the citation survives its host.