CVE-2020-1147
Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability
Description
CVE-2020-1147 is a high-severity remote code execution vulnerability affecting Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio. The vulnerability arises when the software fails to check the source markup of XML file input, allowing an attacker to execute arbitrary code in the context of the process responsible for deserialization of the XML content. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 93.43% (99.8th percentile), CVE-2020-1147 has an exceptionally high probability of exploitation, and multiple public exploits are available targeting SharePoint Server deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | .net core | 2.1; 3.1 |
| microsoft | .net framework | 2.0; 3.0; 3.5; 4.6.2; 4.7; 4.7.1; 4.7.2; 4.6; 4.6.1; 4.8; 3.5.1; 4.5.2 |
| microsoft | sharepoint enterprise server | 2013; 2016 |
| microsoft | sharepoint server | 2010; 2019 |
| microsoft | visual studio 2017 | >= 15.0, <= 15.9 |
| microsoft | visual studio 2019 | >= 16.0, <= 16.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147(Patch, Vendor Advisory)
- https://www.exploitalert.com/view-details.html?id=35992(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1147(US Government Resource)
Weakness Type
Improper Validation of XML Input
CVE-2020-1147 involves improper validation of XML file input in the .NET Framework DataSet and DataTable deserialization process. When the software fails to check the source markup of XML data, an attacker can craft a malicious XML document that, when processed by the application, leads to arbitrary code execution. This affects any .NET application that uses DataSet or DataTable to deserialize XML, including SharePoint Server and Visual Studio.
Learn more: CVE-2020-1147 — Microsoft Security Advisory
Impact Analysis
CVE-2020-1147 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting a serious threat across a broad attack surface that spans .NET Framework, SharePoint Server, and Visual Studio. The attack requires local access and user interaction (such as opening a malicious XML document), but the low attack complexity makes exploitation straightforward once a user is tricked into processing the crafted file. Confidentiality (High): An attacker gains access to all data accessible by the process handling the XML deserialization, which on SharePoint servers includes email data, documents, and credentials. Integrity (High): Successful exploitation allows modification of application data, deployment of web shells, and alteration of system configurations. Availability (High): Complete process compromise can result in service disruption and system instability. The EPSS score of 93.43% (99.8th percentile) places this vulnerability among the most likely to be exploited, and the breadth of affected products across .NET Framework, SharePoint, and Visual Studio significantly amplifies organizational risk.
Exploit Maturity
CVE-2020-1147 has a highly mature exploit landscape with multiple public exploits available. Public exploit code is available via Packet Storm Security, including a SharePoint DataSet/DataTable Deserialization exploit and a Microsoft SharePoint Server 2019 Remote Code Execution exploit. Additional exploit code is available at ExploitAlert. CISA has confirmed active exploitation in the wild by including this vulnerability in its Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 93.43% (99.8th percentile) indicates near-certain exploitation activity across exposed systems.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Microsoft has released security updates for all affected products.
- Update all affected products to patched versions: .NET Core 2.1 and 3.1, .NET Framework 2.0 through 4.8 (including 3.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2), SharePoint Enterprise Server 2013 and 2016, SharePoint Server 2010 and 2019, and Visual Studio 2017 (15.0-15.9) and 2019 (16.0-16.6).
- If immediate patching is not feasible, implement strict input validation on all endpoints that process XML data. Disable or restrict DataSet and DataTable XML deserialization in custom .NET applications where possible. Apply Web Application Firewall (WAF) rules to filter malicious XML payloads targeting SharePoint endpoints.
- Monitor application and IIS logs for indicators of XML deserialization attacks, including unusual DataSet/DataTable processing patterns, suspicious XML file uploads to SharePoint, and unexpected process creation from w3wp.exe or SharePoint worker processes.
- Implement defense-in-depth measures including network segmentation for SharePoint servers, restricting file upload capabilities to trusted users, and conducting regular security reviews of .NET applications that process external XML input.
Technical Details
CVE-2020-1147 targets the XML deserialization mechanism in the .NET Framework's DataSet and DataTable classes. When these classes are used to deserialize XML data from an untrusted source, an attacker can embed malicious type information within the XML markup that causes the .NET runtime to instantiate arbitrary types during deserialization, leading to remote code execution. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that the attack requires local access with user interaction, such as opening a crafted document or navigating to a page that processes the malicious XML. The vulnerability affects a wide range of Microsoft products because the underlying DataSet/DataTable deserialization is a core .NET Framework feature used across SharePoint Server, Visual Studio, and custom .NET applications.
Frequently Asked Questions
Is CVE-2020-1147 being actively exploited?
Yes. CVE-2020-1147 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Multiple public exploits are available, and the EPSS score of 93.43% (99.8th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2020-1147?
CVE-2020-1147 affects a broad range of Microsoft products: .NET Core 2.1 and 3.1, .NET Framework 2.0 through 4.8, SharePoint Enterprise Server 2013 and 2016, SharePoint Server 2010 and 2019, and Visual Studio 2017 (15.0-15.9) and 2019 (16.0-16.6).
How do I fix CVE-2020-1147?
Apply the security updates provided by Microsoft for all affected products. Ensure all .NET Framework, SharePoint Server, and Visual Studio installations are updated to the latest patched versions. If immediate patching is not possible, restrict XML deserialization capabilities and implement WAF rules to filter malicious XML input.
How severe is CVE-2020-1147?
CVE-2020-1147 has a CVSS 3.1 score of 7.8 (HIGH). The EPSS score of 93.43% places it in the 99.8th percentile, indicating this is among the most likely vulnerabilities to be exploited. The breadth of affected products across .NET Framework, SharePoint, and Visual Studio significantly amplifies organizational risk.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.