Remote Code Execution in SharePoint via Workflow Compilation [CVE-2021-26420]
We discussed this vulnerability during Episode 89 on 11 October 2021
SharePoint Workflows are essentially a series of tasks to streamline a business process. With the clear potential for abuse there exist an authorizedTypes
list that will both allow and block classes. One of the classes blocked is the WorkflowCompiler
which as the name implies is the class used to compile a workflow. If a workflow could invoke the compiler it would be possible to modify the restrictions the compiler enforced and compile and run an otherwise blocked workflow.
So, its not, at least as far as this exploit goes possible to use teh WorkflowCompiler
with default configuration, however much of the compiler’s implementation resides in the WorkflowCompilerInternal
class which is not blocked.