Remote Code Execution in SharePoint via Workflow Compilation [CVE-2021-26420]

We discussed this vulnerability during Episode 89 on 11 October 2021

SharePoint Workflows are essentially a series of tasks to streamline a business process. With the clear potential for abuse there exist an authorizedTypes list that will both allow and block classes. One of the classes blocked is the WorkflowCompiler which as the name implies is the class used to compile a workflow. If a workflow could invoke the compiler it would be possible to modify the restrictions the compiler enforced and compile and run an otherwise blocked workflow.

So, its not, at least as far as this exploit goes possible to use teh WorkflowCompiler with default configuration, however much of the compiler’s implementation resides in the WorkflowCompilerInternal class which is not blocked.