CVE-2021-31181: MicroSoft SharePoint webpart interpretation co | PT SWARM

CVE-2021-31181: MicroSoft SharePoint webpart interpretation conflict RCE vulnerability

To quote @thezdi: "this vulnerability could be used by an authenticated user to execute arbitrary code on the server in the context of the service account of the SharePoint web application. For a successful attack, the attacker must have SPBasePermissions.ManageLists permissions on any SharePoint site. By default, any authenticated user can create their own site where they have the necessary permission."

Contents:
• The Vulnerability
• Proof of Concept
• Getting Remote Code Execution
• Conclusion

https://www.zerodayinitiative.com/blog/2021/6/1/cve-2021-31181-microsoft-sharepoint-webpart-interpretation-conflict-remote-code-execution-vulnerability