非影资讯
P非影 English
面向安全从业者的中英双语安全研究与漏洞情报精选。

[CVE-2024-38018] SharePoint Unknown CVE Unveiled: RCE via WebPart Properties Deserialization

blog.viettelcybersecurity.com | 漏洞 | CVE-2024-38018 | #rce | #deserialization | #sharepoint | #webpart | #cve-2024-38018 | #binaryformatter

摘要

后经分配为 CVE-2024-38018 的 SharePoint 漏洞：SPSerializationBinder 允许通过 WebPart 附加属性对 SafeControls 类进行二进制反序列化，配合改造的 ysoserial 载荷可实现 RCE。
发布时间
收录时间

原文 ↗

相关内容

  1. CVE-2026-33112: SharePoint XmlValidator Bypass Enables Low-Privilege RCE (blog.viettelcybersecurity.com)
  2. SharePoint ToolShell – One Request PreAuth RCE Chain (blog.viettelcybersecurity.com)
  3. CVE-2022-22005 Microsoft SharePoint RCE 漏洞分析 (blog.viettelcybersecurity.com)
  4. CVE-2026-20963 Analysis (blog.viettelcybersecurity.com)
  5. CVE-2026-55040: SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login (blog.viettelcybersecurity.com)
  6. CVE-2022-21587 (Oracle E-Business Suite Unauthenticated RCE) (blog.viettelcybersecurity.com)

返回