Listen to this Post
CVE-2025-30382 is a deserialization vulnerability in Microsoft SharePoint that enables remote code execution (RCE) due to improper validation of user-supplied data during deserialization. Attackers craft malicious serialized objects embedded in SharePoint requests, which, when processed, trigger arbitrary code execution under the application’s context. The flaw stems from insecure .NET deserialization practices, where untrusted data is passed to dangerous formatters like `BinaryFormatter` without proper checks. Exploitation requires no authentication, allowing attackers to compromise SharePoint servers by sending crafted payloads via network-accessible endpoints.
DailyCVE Form
Platform: Microsoft SharePoint
Version: 2019/Online
Vulnerability: RCE via Deserialization
Severity: Critical
Date: 05/19/2025
What Undercode Say:
Exploitation:
1. Craft a malicious serialized payload using `ysoserial.net`:
ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "calc.exe" -o base64
2. Embed payload in SharePoint API requests:
POST /_api/web/lists HTTP/1.1 Host: target-sharepoint Content-Type: application/xml X-SharePoint-Exploit: <base64_payload>
Detection:
- Audit logs for abnormal `BinaryFormatter` usage:
Get-WinEvent -LogName "Application" | Where-Object { $_.Message -match "BinaryFormatter.Deserialize" }
Mitigation:
1. Apply Microsoft patch KB5030282.
2. Disable risky formatters via `web.config`:
<configuration> <system.web> <machineKey validation="SHA1" decryption="AES" /> </system.web> </configuration>
3. Restrict SharePoint endpoints via WAF rules:
location ~ ^/_api/ { deny all; }
Code Analysis:
- Vulnerable .NET snippet:
BinaryFormatter formatter = new BinaryFormatter(); object obj = formatter.Deserialize(maliciousStream); // Unsafe
- Secure alternative:
var safeSerializer = new DataContractSerializer(typeof(SafeObject)); safeSerializer.ReadObject(cleanStream);
References:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
