CVE-2020-1147
Published: 14 July 2020
Summary
CVE-2020-1147 is a high-severity an unspecified weakness vulnerability in Microsoft .Net Framework. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A remote code execution vulnerability tracked as CVE-2020-1147 affects .NET Framework, Microsoft SharePoint, and Visual Studio. The flaw occurs when these components fail to validate the source markup of XML file input, allowing untrusted data to be processed without sufficient checks.
An attacker with the ability to supply a malicious XML file can trigger the vulnerability to execute arbitrary code. The CVSS 7.8 score reflects a local attack vector that requires no privileges but does need user interaction, resulting in high impact to confidentiality, integrity, and availability.
Public exploit code targeting Microsoft SharePoint Server 2019 has been posted to PacketStorm Security, demonstrating deserialization of untrusted DataSet or DataTable content. The Microsoft Security Response Center advisory provides official guidance and patches for affected products.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-3898
Vulnerability details
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of XML input markup to block untrusted DataSet/DataTable deserialization that enables the RCE.
Mandates prompt application of Microsoft patches that remediate the unsafe XML processing flaw in .NET/SharePoint/Visual Studio.
Requires integrity verification of software and input data to detect or block tampered XML that triggers arbitrary code execution.