CVE-2021-31181

HIGH

Microsoft SharePoint - Remote Code Execution via Unsafe Control and ViewState

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-31181. PoCs published by Unknown, Spencer McIntyre, wvu, including Metasploit module exploits/windows/http/sharepoint_unsafe_control.

AI-analyzed exploit summary This Metasploit module exploits a SharePoint vulnerability (CVE-2021-31181) by leaking the ViewState validation key and using it to execute arbitrary commands via deserialization. It targets SharePoint 2016/2019 and supports multiple payload types.

Description

Microsoft SharePoint Remote Code Execution Vulnerability

Exploits (1)

metasploit WORKING POC EXCELLENT

by Unknown, Spencer McIntyre, wvu · rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_unsafe_control.rb

View Code ZIP pw:eip

This Metasploit module exploits a SharePoint vulnerability (CVE-2021-31181) by leaking the ViewState validation key and using it to execute arbitrary commands via deserialization. It targets SharePoint 2016/2019 and supports multiple payload types.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Microsoft SharePoint 2016/2019 (pre-May 2021 patches)

Auth required

Prerequisites: Valid SharePoint credentials or session cookie · Access to SharePoint web interface

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31181

Third Party Advisory, VDB Entry x_refsource_misc

https://www.zerodayinitiative.com/advisories/ZDI-21-573/

Exploit, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/163208/Microsoft-SharePoint-Unsafe-Control-And-ViewState-Remote-Code-Execution.html

Various Sources

https://packetstorm.news/files/id/163208

Scores

CVSS v3 8.8

EPSS 0.3004

EPSS Percentile 98.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-94

Status published

Products (3)

microsoft/sharepoint_enterprise_server 2016

microsoft/sharepoint_foundation 2013 sp1

microsoft/sharepoint_server 2019

Published May 11, 2021

Tracked Since Feb 18, 2026