Room for Escape: Scribbling Outside the Lines of Template Security

Overview: Alvaro Muñoz, staff security researcher at GitHub Security Lab, and Oleksandr Mirosh, security researcher at Micro Focus Fortify, analyze template security and sandbox escape vulnerabilities in enterprise Content Management Systems (CMS). The talk investigates how dynamic template evaluation in enterprise environments can be exploited to achieve remote code execution. Focusing on Microsoft SharePoint Server in its default configuration, the authors demonstrate how standard unprivileged users can bypass SharePoint Safe Mode parser restrictions.

Key Topics: - SharePoint ASPX page architecture (Application Pages vs. Site Pages in Safe Mode) - SPPageParserFilter mechanics and safe mode bypass techniques - Escalating arbitrary file read to RCE via web.config machineKey and ViewState deserialization - Exploiting dangerous controls in SafeControls (ObjectDataSource and ContactLinkSuggestionMicroView)

Technical Details: Alvaro Muñoz and Oleksandr Mirosh analyze server-side template sandboxes across .NET and Java enterprise CMS platforms. In Microsoft SharePoint, pages fall into two architectures: Application Pages, which are stored on the local file system and execute unrestricted server-side C# code, and Site Pages, which are stored in the backend content database and can be edited or created by standard users. Site Pages are processed under SharePoint's Safe Mode, enforced by SPPageParserFilter. Safe Mode prohibits server-side compilation, inline code blocks, server-side includes (SSI), and dynamic event bindings, restricting controls exclusively to those explicitly enumerated in the SafeControls allowlist in web.config.

The researchers audited SharePoint's parsing pipeline to find scenarios where SPPageParserFilter is bypassed or inconsistently applied. The parser filter is omitted if the ParseControl API is invoked with a single argument or when the ignoreParseFilter parameter is explicitly set to true. Furthermore, SharePoint employs EditingPageParser.VerifyControlOnSafeList during design-time operations instead of runtime filtering. When Safe Mode is escaped, attackers cannot directly compile arbitrary code, but they can invoke dangerous controls. For example, the ObjectDataSource control allows invoking arbitrary public methods on public types, enabling immediate code execution via System.Diagnostics.Process.Start. Alternatively, controls like XmlDataSource or Server-Side Include (SSI) directives allow reading arbitrary local files.

The speakers demonstrated two critical attack vectors against default-configured SharePoint servers by unprivileged users without administrative privileges. First, VerifyControlOnSafeList contains a flaw where it fails to block SSI directives when its blockServerSideIncludes parameter is passed as false in design mode. Attackers supplied malicious markup inside the webPartXml parameter of the RenderWebPartForEdit web service method, successfully reading web.config. By extracting the validationKey from the machineKey section in web.config (or internal properties), the authors crafted a malicious serialized ViewState using ysoserial.net, resulting in arbitrary OS command execution. Second, auditing the default SafeControls list uncovered ContactLinkSuggestionMicroView, which accepted user request parameters directly into DataSet.ReadXml(), triggering vulnerable XML deserialization via XmlSerializer with an attacker-controlled target type.

Key Takeaways: Allowlist-based template sandboxes frequently fail due to inconsistencies between design-time rendering and runtime enforcement. Exposing diagnostic or design-mode endpoints that bypass parser filters can allow unprivileged users to extract machine keys and escalate to full remote code execution via ViewState deserialization. Organizations must audit SafeControls declarations to ensure controls do not accept untrusted input into deserialization methods, disable unnecessary web services, and ensure security patches are promptly applied to SharePoint servers.

(AI summary — Gemini Flash)