CVE-2020-0646
CRITICAL KEV NUCLEI.NET Framework - Remote Code Execution via XML Injection
Title source: llmExploitation Summary
CVE-2020-0646 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021.
EIP tracks 2 public exploits from researchers including Metasploit, Spencer McIntyre, Soroush Dalili, including a Metasploit module exploits/windows/http/sharepoint_workflows_xoml.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits CVE-2020-0646, a vulnerability in SharePoint's workflow functionality that allows remote code execution via specially crafted XOML data. The exploit injects commands into a workflow markup, triggering arbitrary command execution on the target system.
Description
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
Exploits (2)
This Metasploit module exploits CVE-2020-0646, a vulnerability in SharePoint's workflow functionality that allows remote code execution via specially crafted XOML data. The exploit injects commands into a workflow markup, triggering arbitrary command execution on the target system.
This Metasploit module exploits CVE-2020-0646, a vulnerability in SharePoint's workflow XOML processing, allowing remote command execution via crafted SOAP requests. It injects commands into the XOML markup, bypassing validation to achieve RCE.
Nuclei Templates (1)
server:"ms .net remoting"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H