Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

SharePoint Server is an on-premises collaboration platform used by many organizations that is built in .NET. The bug turns into RCE via a deserialization sink.

In the web page designer called ToolPane, it takes in an allowlist to stop the creation of arbitrary .NET types. Markup is submitted to this tool, that will then create a <%@ Register %> directive around it and a tag block.

First, a security check for the types being used happens. After this, RegisterDirective.GetHtml() reserializes the attribute by writing into into a raw value between two double quotes. If this value contains double or single quotes, we can break out of that context, allowing XAML injection similar to XSS.

With the ability to add arbitrary tags after the security check, it possible to add XAML that will give us a deserialization primitive. And thus, code execution.

Besides this (and what makes it much worse), the author of this post found a way to make this call unauthenticated. WebPartPage.OnInit() calls CreateToolPane() unconditionally before any auth bugs. Apparently, they knew about this for a long time but didn't report it because it had no impact.

Overall, they had two bugs: an authentication bypass for trigger the attack surface, and an RCE sink via bad parsing. To me, I have two takeaways:

1. Hold onto bugs that aren't critical: A low finding, or informational in this case, didn't matter so why report it? You could use it to get the full impact. After all, a critical pays 100x a low.
2. Manual string creation is bad with languages. Don't do it. You'll have ea bug somewhere.