Microsoft SharePoint Exploit Attempt - CVE-2021-31181

Microsoft SharePoint has a vulnerability in the EditingPageParser.VerifyControlOnSafeList method, which allows an attacker to bypass a list of safe controls that prevent users from creating unauthorized SharePoint widgets. To exploit this vulnerability and perform remote code execution (RCE), the attacker first performs reconnaissance to identify a target site on a SharePoint server. Next, the attacker exploits the vulnerable method to upload a malicious WebPart control. A WebPart control enables end-users to modify the content of web pages. The malicious WebPart control exposes validation and encryption keys from a configuration file in a web page. With these keys, the attacker can create a malicious View State. A View State stores object data for a dynamic web page that is deserialized by the server. Finally, the attacker sends an HTTP request with the malicious View State to the SharePoint server, which results in RCE.