CVE-2020-0646
published 2020-01-14CVE-2020-0646: A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution…
PriorityP195critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
99.22%
99.9th percentile
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
Affected
99 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_net_framework_3.0 | — | — |
| microsoft | microsoft_net_framework_3.0 | — | — |
| microsoft | microsoft_net_framework_3.0 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5.1 | — | — |
| microsoft | microsoft_net_framework_3.5.1 | — | — |
| microsoft | microsoft_net_framework_3.5.1 | — | — |
| microsoft | microsoft_net_framework_3.5.1 | — | — |
| microsoft | microsoft_net_framework_3.5.1 | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.6.2_4.7_4.7.1_4.7.2_on_windows_10_version_1607 | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.6.2_4.7_4.7.1_4.7.2_on_windows_server_2016 | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.1_4.7.2_on_windows_10_version_1709_for_32-bi | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.1_4.7.2_on_windows_10_version_1709_for_x64-b | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.2_on_windows_10_for_32-bit_systems | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.2_on_windows_10_for_x64-based_systems | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.2_on_windows_10_version_1803_for_32-bit_syst | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.2_on_windows_10_version_1803_for_x64-based_s | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.2_on_windows_10_version_1809_for_32-bit_syst | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.2_on_windows_10_version_1809_for_x64-based_s | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandSystem.Diagnostics.Process.Start
otherValidateWorkflowMarkupAndCreateSupportObjectsResponse
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT .NET Framework Remote Code Execution Injection (CVE-2020-0646)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"_vti_bin"; content:"/webpartpages.asmx"; endswith; http.request_body; content:"<?xml"; content:"System.Diagnostics.Process.Start"; fast_pattern; reference:url,dl.packetstormsecurity.net/2003-exploits/sharepoint_workflows_xoml.rb.txt; reference:cve,2020-0646; classtype:attempted-admin; sid:2034509; rev:1; metadata:created_at 2021_11_18, cve CVE_2020_0646, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_11_18, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
- →Exploit sends an HTTP POST to the SharePoint endpoint /_vti_bin/webpartpages.asmx with Content-Type text/xml containing specially crafted XOML data embedding System.Diagnostics.Process.Start for command execution.
- →A successful exploitation response contains the XML element ValidateWorkflowMarkupAndCreateSupportObjectsResponse in the HTTP response body.
- →The Metasploit check method distinguishes patched vs vulnerable systems by inspecting compiler error messages: a patched system returns a compiler error matching 'is not a valid language-independent type name'. ↗
- →The exploit uses Windows NTLM authentication to reach the SharePoint endpoint; monitor for NTLM-authenticated POST requests to /_vti_bin/webpartpages.asmx.
- →Exploit artifacts are left on disk and evidence appears in logs (IOC_IN_LOGS, ARTIFACTS_ON_DISK) — check SharePoint ULS logs and the filesystem for dropped executables. ↗
- ·The Metasploit module defaults to RPORT 443 with SSL enabled; detection rules should cover both HTTP (80) and HTTPS (443) traffic to the SharePoint endpoint. ↗
- ·The module requires valid Windows domain credentials (USERNAME, PASSWORD, DOMAIN) to authenticate; unauthenticated exploitation is not demonstrated in the available sources. ↗
- ·The Nuclei template requires the requests_ntlm Python package and valid credentials; without them it falls back to unauthenticated requests which may not succeed.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_msrc9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4w3v-83v8-mg94: A remote code execution vulnerability exists when the Microsoft
ghsa_unreviewed·2022-05-24
CVE-2020-0646 [HIGH] CWE-20 GHSA-4w3v-83v8-mg94: A remote code execution vulnerability exists when the Microsoft
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
VulnCheck
Microsoft .NET Framework Remote Code Execution Vulnerability
vulncheck·2020·CVSS 9.8
CVE-2020-0646 [CRITICAL] CWE-91 Microsoft .NET Framework Remote Code Execution Vulnerability
Microsoft .NET Framework Remote Code Execution Vulnerability
Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.
Affected: Microsoft .NET Framework
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-05-03
CISA
Microsoft .NET Framework Remote Code Execution Vulnerability
cisa·2021-11-03·CVSS 9.8
CVE-2020-0646 [CRITICAL] CWE-91 Microsoft .NET Framework Remote Code Execution Vulnerability
Vulnerability: Microsoft .NET Framework Remote Code Execution Vulnerability
Affected: Microsoft .NET Framework
Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-0646
Remediation Due Date: 2022-05-03
Microsoft
.NET Framework Remote Code Execution Injection Vulnerability
vendor_msrc·2020-01-14·CVSS 9.8
CVE-2020-0646 [CRITICAL] .NET Framework Remote Code Execution Injection Vulnerability
.NET Framework Remote Code Execution Injection Vulnerability
Description: A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
To exploit the vulnerability, an attacker would need to pass specific input to an application utilizing susceptible .Net methods.
The security update addresses the vulnerability by correcting how the Microsoft .NET Framework validates input
Suricata
ET EXPLOIT .NET Framework Remote Code Execution Injection (CVE-2020-0646)
suricata·2021-11-18·CVSS 9.8
CVE-2020-0646 [CRITICAL] ET EXPLOIT .NET Framework Remote Code Execution Injection (CVE-2020-0646)
ET EXPLOIT .NET Framework Remote Code Execution Injection (CVE-2020-0646)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT .NET Framework Remote Code Execution Injection (CVE-2020-0646)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"_vti_bin"; content:"/webpartpages.asmx"; endswith; http.request_body; content:"<?xml"; content:"System.Diagnostics.Process.Start"; fast_pattern; reference:url,dl.packetstormsecurity.net/2003-exploits/sharepoint_workflows_xoml.rb.txt; reference:cve,2020-0646; classtype:attempted-admin; sid:2034509; rev:1; metadata:created_at 2021_11_18, cve CVE_2020_0646, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_11_18, mitre_tactic_id TA0001, mitre
Exploit-DB
SharePoint Workflows - XOML Injection (Metasploit)
exploitdb·2020-03-31
CVE-2020-0646 SharePoint Workflows - XOML Injection (Metasploit)
SharePoint Workflows - XOML Injection (Metasploit)
---
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
class MetasploitModule 'SharePoint Workflows XOML Injection',
'Description' => %q{
This module exploits a vulnerability within SharePoint and its .NET backend
that allows an attacker to execute commands using specially crafted XOML data
sent to SharePoint via the Workflows functionality.
},
'Author' => [
'Spencer McIntyre',
'Soroush Dalili'
],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2020-0646'],
['URL', 'https://www.mdsec.co.uk/2020/01/code-injection-in-workflows-leading-to-sharepoint-rce-cve-2020-0646/']
],
'Platform' => 'win',
'Targets' => [
[ 'Windows EXE Dropper', { 'Arch' => [ARCH_X86,
Nuclei
Microsoft .NET Framework - Remote Code Execution
nuclei·CVSS 9.8
CVE-2020-0646 [CRITICAL] Microsoft .NET Framework - Remote Code Execution
Microsoft .NET Framework - Remote Code Execution
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
Template:
id: CVE-2020-0646
info:
name: Microsoft .NET Framework - Remote Code Execution
author: pszyszkowski
severity: critical
description: |
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
remediation: |
Apply Microsoft security patches as described in the February 2020 SharePoint security update.
impact: |
Attackers can execute arbitrary code remotely, potentially leading to full system compromise.
reference:
- https://www.cv
Metasploit
SharePoint Workflows XOML Injection
metasploit
SharePoint Workflows XOML Injection
SharePoint Workflows XOML Injection
This module exploits a vulnerability within SharePoint and its .NET backend that allows an attacker to execute commands using specially crafted XOML data sent to SharePoint via the Workflows functionality.
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Talos
Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage
blogs_talos·2020-01-14·CVSS 8.1
CVE-2020-0601 [HIGH] Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage
## Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage
By Jon Munshaw. Updated January 15th: Added an Advanced Custom Detection (ACD) signature for AMP that can be used to detect exploitation of CVE-2020-0601 by spoofing certificates masquerading as a Microsoft ECC Code Signing Certificate Authority.
Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month's Patch Tuesday covers 49 vulnerabilities, eight of which are considered critical.
This month's security update is particularly important for its disclosure of two vulnerabilities related to a core cryptographic component in all versions of Windows. CVE-2020-0601 could allow an attacker to use cryptography
Tenable
Microsoft’s January 2020 Patch Tuesday Kicks Off the New Year with 49 New CVEs
blogs_tenable·2020-01-14
Microsoft’s January 2020 Patch Tuesday Kicks Off the New Year with 49 New CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage
blogs_talos·2020-01-14·CVSS 8.1
CVE-2020-0601 [HIGH] Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage
By Jon Munshaw.
Updated January 15th: Added an Advanced Custom Detection (ACD) signature for AMP that can be used to detect exploitation of CVE-2020-0601 by spoofing certificates masquerading as a Microsoft ECC Code Signing Certificate Authority.
Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month's Patch Tuesday covers 49 vulnerabilities, eight of which are considered critical.
This month's security update is particularly important for its disclosure of two vulnerabilities related to a core cryptographic component in all versions of Windows. CVE-2020-0601 could allow an attacker to use cryptography to sign a malicious executable, making the file appear as if it was from a trusted sou
Crowdstrike
Vulnerability Roundup: 10 Critical CVEs of 2020
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] Vulnerability Roundup: 10 Critical CVEs of 2020
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
http://packetstormsecurity.com/files/156930/SharePoint-Workflows-XOML-Injection.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0646http://packetstormsecurity.com/files/156930/SharePoint-Workflows-XOML-Injection.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0646https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0646
2020-01-14
Published
2021-11-03
Added to CISA KEV
Exploited in the wild