Post #4020849
2026-07-22 22:29 UTC
From a SharePoint vulnerability perspective, this is the most trivial exploit I think I've ever seen.
The exploit is a single web request to SERVERNAME/_trust/default.aspx
In the request to this endpoint, there's a
XML structure, where the value is serialized data that is unsafely deserialized by the SharePoint server.
At this point, SharePoint executes whatever is specified in the ysoserial.net-created serialization blob.
That's it. No special sequence of events. No tricky to get to endpoint. No need to authenticate in any way.
Replies (1)
-
@wdormann@infosec.exchange 2026-07-23 12:07
Obviously, popping calc.exe is something only a person like me would do. A real attacker would probably use this to steal your server's machineKey. With this, an attacker retains control of your web server, indefinitely. (Even after patches are installed, and even if you did any sort of clean-up short of rotating the machineKey value. Because they care about security, Microsoft has provided optional guidance for performing machineKey rotation. You should probably do this.