Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Company
Platform
Modern NDR
Resources
Company
DETECTION OVERVIEW
Risk Factors
This SharePoint vulnerability is one of the top routinely exploited vulnerabilities. An attacker must create custom exploit code and XML-serialized payload, which can be difficult to create. But a successful exploit can enable remote code execution (RCE), providing access to sensitive files and a pivot point to the internal network.
Category
Developers can create custom applications built on the Microsoft ASP.NET framework for their Microsoft SharePoint deployments. A vulnerable Active Server Pages Extended (ASPX) web page generated by ASP.NET, Picker.aspx, has hidden form fields that allow for user-supplied input. SharePoint has an XML-deserialization vulnerability where SharePoint fails to check serialized data sent to those form fields. Serialized data can be converted into different file formats, such as XML or Java. An attacker creates an HTTP POST request with malicious form data and payloads and sends the request to the target ASPX page. A specific combination of the serialized data and form parameters results in RCE. The code runs with privileges associated with the SharePoint application pool and the SharePoint server farm account.
Network analysis and visibility solutions remain underrepresented in enterprises. Find out why in this preview of a new Wave report.
ExtraHop® Named a Leader in First-Ever Gartner® Magic Quadrant™ for Network Detection and Response
Visit this resource for more information.
This analysis exposes the critical link between an organization's lack of internal visibility and the escalating cost of compromise, demanding an urgent re-evaluation of how core business assets are protected.
Learn why you need to be wary of the claims certain network detection and response providers make about their coverage against the MITRE ATT&CK framework.
Learn how NDR from RevealX helps security teams detect and investigate more adversary TTPs in the MITRE ATT&CK framework than rule-based tools.
