A working proof-of-concept exploit for CVE-2026-33112, a critical vulnerability in Microsoft SharePoint that allows low-privilege authenticated users to achieve remote code execution by bypassing the XmlValidator security control.
The flaw represents a fresh bypass of Microsoft’s second patch for CVE-2025-53770, highlighting the persistent difficulty of fully remediating deserialization-based attack chains in SharePoint’s DataSet handling.
PoC for SharePoint RCE Vulnerability
Microsoft’s second fix for CVE-2025-53770 introduced a new TypeNameParserImpl that changed how SharePoint parses type names for DataSet objects, successfully closing the generic type name bypass used in earlier exploits.
According to Viettel Security PoC, the SharePoint builds an XSD schema set during deserialization, an attacker can abuse the <xsd:import> and <xsd:include> elements to reference external XSD schemas hosted on an attacker-controlled server.
Because the imported schema is fetched over the network rather than being present locally, the XmlValidator fails to inspect it, effectively blinding the validation logic. This creates a gap where malicious type definitions slip past the very check designed to stop them.
Since ExcelDataSet is already flagged as an unsafe control, invoking its get_DataTable() method directly isn’t straightforward. The PoC instead targets Microsoft.PerformancePoint.Scorecards.WebServer.BIMonitoringAuthoringService, exposed at /_vti_bin/PPS/PPSAuthoringService.asmx.
Specifically, the TestConnection function accepts a DataSource object, and when it tests the connection, it triggers ExcelDataSet.get_DataTable() indirectly — sidestepping the safe control enforcement entirely.
Viettel Security resarchers note this is one of several known techniques for bypassing SharePoint’s safe control checks, with related CVEs offering alternative bypass paths documented in prior community analysis.
Reproduction Steps
The disclosed PoC requires only site-member-level access:
- Log in as a low-privilege site member.
- Create a SharePoint list (e.g., named “test”) and add a single list item.
- Stand up an HTTP server to host the malicious external XSD schema, then confirm the SharePoint server can reach it.
- Craft the exploit request, setting the
ItemUrlparameter to match the created item’s path — for example,/sites/zdi/Lists/test/1_.123for item ID 1 in/sites/zdi/Lists/test/. - Submit the request to
PPSAuthoringService.asmx.
Successful exploitation spawns win32calc.exe, confirming arbitrary code execution on the SharePoint server.
CVE-2026-33112 is particularly severe because it requires no elevated privileges — any authenticated site member can trigger it. Combined with the network-based XSD import technique, this makes detection harder, since the malicious payload isn’t fully contained within the request itself.
Organizations running on-premises SharePoint should treat this as an urgent patching priority following Microsoft fix. In the interim, security teams should monitor outbound HTTP traffic from SharePoint servers to unfamiliar external hosts, restrict _vti_bin endpoint access where feasible, and audit PPSAuthoringService.asmx usage logs for anomalous TestConnection calls.
