SharePoint Vulnerability Allows Authenticated Remote Code Execution

…registering arbitrary .NET classes after the type check runs but before the control is loaded. With arbitrary class loading, the attacker uses XamlServices.Parse() to trigger code execution through deserialization. The writeup includes a working in-memory webshell payload that avoids the registry permission failures other deserialization methods encounter , Khoa said. The researcher also demonstrated that the flaw can be chained with a separate, already-patched authentication bypass to reach pre-authentication remote code execution on servers configured to allow…