^{CVE-2020-0646:}Microsoft .NET Framework Remote Code Execution Vulnerability (CVE-2020-0646)

Overview

CVE-2020-0646 is a remote code execution vulnerability in Microsoft .NET Framework that affects SharePoint Server. The vulnerability is classified as CWE-91 (XML Injection) and allows attackers to inject malicious XML content into XOML workflow files. When SharePoint processes these files, the improper input validation in the .NET Framework can lead to remote code execution.

The vulnerability specifically affects the way SharePoint workflows handle XOML (Extensible Object Markup Language) files. An authenticated attacker with permissions to create or modify workflows could exploit this vulnerability to execute arbitrary code in the context of the SharePoint application pool or server process.

The exploitation of this vulnerability could allow attackers to install programs, view, change, or delete data, or create new accounts with full user rights, depending on the context in which the vulnerable application runs.

Remediation

1. Apply the security update released by Microsoft in January 2020 security updates.
2. Ensure that all .NET Framework installations are updated to the latest patched version.
3. Restrict SharePoint workflow creation and modification permissions to trusted users only.
4. Monitor SharePoint logs for suspicious workflow creation or modification activities.
5. Consider implementing network segmentation to limit the impact of potential exploitation.
6. Review and validate all existing SharePoint workflows for potential malicious content.
7. Implement the principle of least privilege for SharePoint users and service accounts.
8. Consider using Microsoft Defender ATP or similar security solutions to detect and prevent exploitation attempts.

References

1. Microsoft Security Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0646
2. Packet Storm Security - SharePoint Workflows XOML Injection: http://packetstormsecurity.com/files/156930/SharePoint-Workflows-XOML-Injection.html
3. Common Weakness Enumeration (CWE-91): https://cwe.mitre.org/data/definitions/91.html
4. Microsoft January 2020 Security Updates: https://msrc.microsoft.com/update-guide/releaseNote/2020-Jan