CVE-2020-0646
Microsoft .NET Framework Remote Code Execution Vulnerability
Description
CVE-2020-0646 is a critical-severity remote code execution vulnerability affecting Microsoft .NET Framework. The vulnerability arises from an XML Injection (XPath Injection) weakness where the .NET Framework fails to validate input properly, allowing an attacker to inject and execute arbitrary code remotely. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 93.87% (99.9th percentile), CVE-2020-0646 has an exceptionally high probability of exploitation, making immediate patching critical for organizations running affected .NET Framework versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | .net framework | 3.0; 3.5; 4.6.2; 4.7; 4.7.1; 4.7.2; 4.8; 3.5.1; 4.5.2; 4.6; 4.6.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156930/SharePoint-Workflows-XOML-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0646(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0646(US Government Resource)
Weakness Type
CWE-91: XML Injection (aka Blind XPath Injection)
XML Injection occurs when user-controlled input is improperly embedded into XML queries or documents, allowing an attacker to modify the structure and content of the XML data. In the context of CVE-2020-0646, the Microsoft .NET Framework fails to properly validate input, enabling an attacker to craft malicious XML input that leads to remote code execution through the SharePoint Workflows XOML injection vector.
Learn more: CWE-91 — XML Injection (aka Blind XPath Injection)
Impact Analysis
CVE-2020-0646 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting the maximum severity of this vulnerability. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and demands no user interaction, making it trivially exploitable in exposed environments. Confidentiality (High): A successful exploit grants full access to sensitive data processed by the .NET Framework application. Integrity (High): Attackers can modify or inject arbitrary data and code into the application context. Availability (High): Exploitation can result in complete system compromise or denial of service. The EPSS score of 93.87% places this vulnerability in the 99.9th percentile, indicating near-certain exploitation activity across exposed systems.
Exploit Maturity
CVE-2020-0646 has a well-established exploit landscape. Public exploit code is available via Packet Storm Security, demonstrating a SharePoint Workflows XOML injection attack path that leverages this .NET Framework flaw. CISA has confirmed active exploitation in the wild by including this vulnerability in its Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 93.87% (99.9th percentile) indicates near-certain exploitation activity, placing this among the most actively targeted vulnerabilities in the current threat landscape.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Microsoft has released security updates addressing this vulnerability.
- Update all instances of Microsoft .NET Framework to patched versions. Affected versions include .NET Framework 3.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, and 4.8.
- If immediate patching is not feasible, restrict access to SharePoint Workflows and disable XOML-based workflow creation. Apply strict input validation rules on any .NET Framework endpoints that process XML data.
- Monitor application logs and IIS logs for indicators of XML injection attempts, including suspicious XOML workflow submissions and unusual .NET serialization activity.
- Implement defense-in-depth measures including Web Application Firewall (WAF) rules to filter malicious XML payloads, network segmentation to limit lateral movement from compromised .NET applications, and regular security auditing of .NET Framework configurations.
Technical Details
CVE-2020-0646 exploits an XML Injection weakness (CWE-91) in the Microsoft .NET Framework's input validation mechanisms. Specifically, the vulnerability manifests through the SharePoint Workflows XOML (Extensible Object Markup Language) processing pipeline, where attacker-controlled input can be injected into the XML processing logic without proper sanitization. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that the attack requires only network access with no authentication or user interaction, making it a prime target for automated exploitation. The injection allows arbitrary code execution within the context of the .NET Framework process, potentially granting full control over the affected server.
Frequently Asked Questions
Is CVE-2020-0646 being actively exploited?
Yes. CVE-2020-0646 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.87% (99.9th percentile) indicates near-certain exploitation activity, and public exploit code is readily available.
What products are affected by CVE-2020-0646?
CVE-2020-0646 affects Microsoft .NET Framework versions 3.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, and 4.8 across various Windows operating systems.
How do I fix CVE-2020-0646?
Apply the security updates provided by Microsoft per vendor instructions. Ensure all affected .NET Framework installations are updated to the latest patched versions. If immediate patching is not possible, restrict access to XOML workflow processing and implement WAF rules to filter malicious XML input.
How severe is CVE-2020-0646?
CVE-2020-0646 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity rating. The EPSS score of 93.87% places it in the 99.9th percentile, indicating this is among the most likely vulnerabilities to be exploited. Immediate remediation is strongly recommended.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.