Rapid7 Analysis Microsoft SharePoint Remote Code Execution (...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520
• Blog Title: Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)
• Suggested Section: Network Services Pentesting > 80,443 - Pentesting Web Methodology > Microsoft SharePoint, with a cross-reference from Pentesting Web > Deserialization > Basic .Net deserialization

🎯 Content Summary

Overview and severity

CVE-2026-63520 is a remote code execution vulnerability in Microsoft SharePoint's Business Data Connectivity (BDC) subsystem. Rapid7 disclosed it with Microsoft on August 11, 2026, and based its technical analysis on SharePoint Server Subscription Edition 16.0.19725.20210. A remote authenticated attacker who can upload a malicious Business Data Connectivity model file (.bdcm) and trigger its entity can execute arbitr...

🔧 Technical Details

Abusing unrestricted type resolution in declarative metadata: If attacker-controlled XML, JSON, or configuration metadata supplies .NET type names and the application resolves them with unrestricted Type.GetType(), the feature may provide arbitrary type instantiation rather than merely data parsing. In this case, type names shorter than 15 characters follow a limited resolver, but longer names are resolved directly without an assembly or class allowlist. Attackers can therefore use assembly-qualified names for dangerous GAC types. Review type resolvers for length-based branches, fallback paths, and direct calls to reflection APIs.

Converting recursive object construction into code execution: A framework that recursively instantiates attacker-selected types and reflectively assigns nested properties provides a gadget-building primitive. Select a class whose property setter has an execution side effect, create the nested objects it ...

🤖 Agent Actions

Updated src/network-services-pentesting/pentesting-web/microsoft-sharepoint.md.

Added:

• SharePoint BDC unrestricted .NET type-resolution primitive.
• Recursive object construction and reflective property-setter exploitation.
• Compact ObjectDataProvider/Process.Start() example.
• FindSpecificDefault materialization workflow and relevant endpoints.
• DotNetAssembly/LosFormatter alternative chain.
• Gadget-independent detection pivots.
• Internal link to existing .NET deserialization coverage.
• Numbered references to ZDI, ysoserial.net, Rapid7, and VulnCheck.

Validation:

• git diff --check passed.
• Internal link resolves.
• Citation numbering is complete.
• Only the intended file changed.
• mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 80,443 - Pentesting Web Methodology > Microsoft SharePoint, with a cross-reference from Pentesting Web > Deserialization > Basic .Net deserialization".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0