An Attack Surface Tour of SharePoint Server
Star-V Lab researchers take a deep dive into Microsoft SharePoint Server, chaining multiple zero-day vulnerabilities to achieve unauthenticated remote code execution.
Summary
Microsoft SharePoint in Enterprise Collaboration
Microsoft SharePoint Server is a foundational intranet CMS and collaboration platform deeply integrated into Active Directory and enterprise data repositories.
Auditing SharePoint Architecture and Web Controls
Yuhao Weng, Steven Seeley, and Zhiniang Peng investigate internal SharePoint web controls, SOAP endpoints, and binary serialization formatters.
Chaining Authentication Bypasses and Deserialization Gadgets
The authors detail discovering multiple critical zero-days, illustrating how to bypass authentication filters and execute arbitrary code as SYSTEM via crafted serialization streams.
Hardening Enterprise SharePoint Environments
The presentation provides enterprise administrators with defensive auditing scripts and reviews Microsoft’s patch mitigations for SharePoint servers.
Related talks
Main Stage·35 min
Jonathan Birch
Jonathan Birch demonstrates novel .NET deserialization RCE attacks that bypass standard assumptions, exploiting database drivers and immutable data streams.
Main Stage·36 min
Jeffrey Hofmann
Jeffrey Hofmann details discovering multiple pre-authentication remote code execution chains in Quest KACE Systems Management Appliance (SMA).
Main Stage·45 min
Aaditya Purani · Max Garrett
Aaditya Purani and Max Garrett expose systemic Electron framework misconfigurations, turning standard web XSS into remote code execution across popular desktop apps.