Rapid7 Analysis Microsoft SharePoint Remote Code Execution (...

src/network-services-pentesting/pentesting-web/microsoft-sharepoint.md

@@ -183,6 +183,56 @@ netsh advfirewall firewall add rule name="Microsoft MsMpEng" dir=out action=allo
 
 Because the rule is created locally (not via GPO) and uses the legitimate Defender binary as `program=`, most SOC baselines ignore it, yet it opens **Any ➜ Any** egress.<sup>[[5]](#references)</sup>
 
+## 4. BDC model metadata as a .NET object-construction sink
+
+SharePoint Business Data Connectivity (BDC) models can act as XML object-graph descriptions rather than passive database schemas. A `TypeDescriptor` can name a .NET type and contain nested descriptors for its fields or properties. Older BDC research already showed that trusting model-defined method parameter types can expose attacker-controlled `XmlSerializer` streams, so `.bdcm` upload and execution permissions form a security boundary.<sup>[[9]](#references)</sup>
+
+### 4.1 Unrestricted type resolution and reflective property assignment
+
+For a `Database` LOB system, `DbTypeReflector.ResolveDotNetType()` sends names shorter than 15 characters through a limited base resolver, but passes names of 15 or more characters directly to `Type.GetType(name, throwOnError: true)`. Without an assembly/type allowlist, an assembly-qualified `TypeName` can therefore select classes available in the Global Assembly Cache. `DotNetTypeReflector.Instantiate()` then recursively constructs the nested descriptors, converts their default values, and assigns them through reflection. The important audit primitive is **attacker-selected type + recursive construction + reflected property setters**, even when no conventional formatter is present.<sup>[[11]](#references)</sup>
+
+A property assignment may execute code rather than only store data. The `ObjectDataProvider` chain uses a nested `ProcessStartInfo` and `Process`; setting `ObjectInstance` refreshes the provider and invokes the method selected by `MethodName` on that object. The generic gadget internals are described on the [.NET deserialization page](../../pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net.md).<sup>[[10]](#references)[[11]](#references)</sup>
+
+```csharp
+var odp = new ObjectDataProvider { MethodName = "Start" };
+var psi = new ProcessStartInfo {
+    UseShellExecute = false,
+    CreateNoWindow = true,
+    FileName = "cmd.exe",
+    Arguments = "/c whoami > C:\\Windows\\Temp\\bdc.txt"
+};
+var process = new Process { StartInfo = psi };
+odp.ObjectInstance = process; // Refresh -> reflective Process.Start()
+```
+
+### 4.2 Store first, materialize later
+
+Uploading the model only stores the graph. A useful trigger must reach default-value construction: a Client Object Model request containing `FindSpecificDefault` calls `CreateDefaultParameterInstancesInternal` and eventually `DotNetTypeReflector.Instantiate()`, so the dangerous setter runs before a useful database result is required. A compact request sequence is:<sup>[[11]](#references)</sup>
+
+```http
+POST /_api/web/folders
+{"__metadata":{"type":"SP.Folder"},"ServerRelativeUrl":"BusinessDataMetadataCatalog"}
+
+POST /_api/web/GetFolderByServerRelativeUrl('BusinessDataMetadataCatalog')/Files/add(url='model.bdcm',overwrite=true)
+
+POST /_vti_bin/client.svc/ProcessQuery
+...
+<Method Name="FindSpecificDefault" ... />
+```
+
+These requests normally require an authorized identity and a valid `X-RequestDigest`; an independent authentication bypass that supplies the Bearer token and digest converts the post-authentication primitive into an unauthenticated chain.<sup>[[11]](#references)</sup>
+
+Do not assume one LOB type or gadget. An independent chain used a `DotNetAssembly` LOB to resolve and instantiate `System.Web.UI.LosFormatter`, then invoked its `Deserialize` instance method with a model-supplied default value. This demonstrates that the durable issue is unsafe type selection/materialization, not an `ObjectDataProvider` signature.<sup>[[12]](#references)</sup>
+
+### 4.3 Detection pivots
+
+Correlate the following server, proxy, and endpoint signals rather than matching only one payload family:<sup>[[11]](#references)[[12]](#references)</sup>
+
+- Creation of `BusinessDataMetadataCatalog`, followed by a `.bdcm` upload through `/_api/web/GetFolderByServerRelativeUrl(...)/Files/add`.
+- `/_vti_bin/client.svc/ProcessQuery` bodies containing BDC entity identities and methods such as `FindSpecificDefault`.
+- Unexpected assembly-qualified `TypeName` values, especially references to `ObjectDataProvider`, `System.Diagnostics.Process`, `ProcessStartInfo`, or `LosFormatter`.
+- Unusual child processes of SharePoint's `w3wp.exe`; keep this process-tree signal even when the model uses a different LOB or gadget.
+
 ---
 
 ## Related tricks
@@ -203,5 +253,9 @@ Because the rule is created locally (not via GPO) and uses the legitimate Defend
 - [6] [CISA – ToolShell exploitation IOCs and activity](https://www.cisa.gov/sites/default/files/2025-08/CMA_SIGMA_251132_1_CVE_2025_53770_ToolShell_TLP_CLEAR.pdf)
 - [7] [Securelist – Analysis of the ToolShell vulnerabilities and exploit code](https://securelist.com/toolshell-explained/117045/)
 - [8] [Eye Security – SharePoint under siege: validated ToolShell analysis](https://labs.eye.security/sharepoint-under-siege/)
+- [9] [ZDI – CVE-2019-1257: Code Execution on Microsoft SharePoint Through BDC Deserialization](https://www.zerodayinitiative.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization)
+- [10] [ysoserial.net – ObjectDataProvider generator](https://github.com/pwntester/ysoserial.net/blob/master/ysoserial/Generators/ObjectDataProviderGenerator.cs)
+- [11] [Rapid7 – Microsoft SharePoint BDC remote code execution analysis](https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520/)
+- [12] [VulnCheck – SharePoint unsafe type RCE chain](https://www.vulncheck.com/blog/cve-2026-63520-sharepoint-unsafe-type-rce)
 
 {{#include ../../banners/hacktricks-training.md}}