CVE-2020-0646
Published: 14 January 2020
Summary
CVE-2020-0646 is a critical-severity aka Blind XPath Injection (CWE-91) vulnerability in Microsoft .Net Framework. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A remote code execution vulnerability exists in the Microsoft .NET Framework when it fails to properly validate input, tracked as CVE-2020-0646 with a CVSS score of 9.8. The flaw is also referenced in connection with SharePoint workflows via XOML injection and is assigned CWE-91 for XML injection issues.
The vulnerability can be exploited remotely by an unauthenticated attacker over the network without user interaction, enabling full compromise of confidentiality, integrity, and availability on affected systems.
Microsoft security advisories at portal.msrc.microsoft.com address the issue and provide patch guidance, while CISA lists the CVE in its known exploited vulnerabilities catalog.
Public exploit references, including PacketStorm disclosures on SharePoint workflow injection, confirm active interest and real-world exploitation potential.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-2140
Vulnerability details
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs to the .NET Framework/SharePoint workflow engine, blocking the XML/XOML injection that enables unauthenticated RCE in CVE-2020-0646.
Mandates prompt application of Microsoft patches that correct the input-validation flaw in the .NET Framework, eliminating the root cause of this RCE vulnerability.
Requires integrity verification of .NET assemblies and workflow definitions, enabling detection of unauthorized code introduced via successful exploitation of the injection flaw.