The vulnerability highlights the critical importance of secure deserialization practices in enterprise applications and the need for comprehensive security reviews of complex application frameworks like SharePoint. According to the Viettel Security report, the vulnerability originates in the SharePoint WebPart control parsing mechanism, specifically within the Microsoft.SharePoint.WebPartPages.WebPart.AddParsedSubObject() method. The attack chain follows a complex deserialization path through multiple SharePoint components, ultimately reaching the vulnerable Microsoft.SharePoint.WebPartPages.Utility.DeserializeStringToObject() function. Successful exploitation grants attackers remote code execution capabilities within the SharePoint application context, potentially leading to complete system compromise. This critical flaw has been patched but remains a significant concern for organizations running vulnerable SharePoint instances. Additionally, network segmentation and monitoring of SharePoint web service endpoints can help detect potential exploitation attempts. This component allows binary deserialization of any class within SharePoint’s SafeControls, creating a significant security gap. The vulnerability affects SharePoint version 15.0.5145.1000 and may also affect other versions.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 17 Jul 2025 10:45:12 +0000