Post #4020224
2026-07-22 21:50 UTC
Looks like somebody [posted an exploit for CVE-2026-50522] (patched in July)(https://gist.githubusercontent.com/testanull/0868e02d81d57d6c59a91261969f7f81/raw/4d16304047e525057d732401f718e20fa830eb0a/SharePoint%2520SE%2520p2o%2520PoC.ps1)
While I can reproduce it on SharePoint Subscription Edition, I didn't get it to work on SharePoint 2016 or 2019. But I could also attribute that to me having no clue how to properly install SharePoint.
Here it is tweaked to run calc.exe as the SharePoint user (sp_farm in my case), as that's a touch more noticeable than it making a web request.
And remember, kids, just installing SharePoint update bits does not update SharePoint. You have to run SharePoint Products Configuration Wizard after installing the updates, which luckily every SharePoint admin knows.
Replies (2)
-
@puppygirlhornypost2@transfem.social 2026-07-22 21:52
@wdormann@infosec.exchange To be fair, I am not sure anyone knows how to "properly install SharePoint"
-
@wdormann@infosec.exchange 2026-07-22 22:29
From a SharePoint vulnerability perspective, this is the most trivial exploit I think I've ever seen. The exploit is a single web request to SERVERNAME/_trust/default.aspx In the request to this endpoint, there's a XML structure, where the value is serialized data that is unsafely deserialized by the SharePoint server. At this point, SharePoint executes whatever is specified in the ysoserial.net-created serialization blob. That's it. No special sequence of events. No tricky to get to endpoint. No need to authenticate in any way.