CVE-2021-31181

Related Files

Microsoft SharePoint Unsafe Control And ViewState Remote Code Execution

Posted Jun 17, 2021

Authored by unknown, Spencer McIntyre, wvu | Site metasploit.com

The EditingPageParser.VerifyControlOnSafeList method fails to properly validate user supplied data. This can be leveraged by an attacker to leak sensitive information in rendered-preview content. This module will leak the ViewState validation key and then use it to sign a crafted object that will trigger code execution when deserialized. Tested against SharePoint 2019 and SharePoint 2016, both on Windows Server 2016.

tags | exploit, code execution

systems | windows

advisories | CVE-2021-31181

SHA-256 | 5dcb06868c15ec6031a011204cbd74de26b37669890217421638293a9f77e49b

Download | Favorite | View