Microsoft SharePoint BDC XML/XAML Deserialization Remote Code Execution

#requires -RunAsAdministrator
# Check-CVE-2019-0604.ps1
# Detects vulnerable Microsoft SharePoint build for CVE-2019-0604
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

# Minimum fixed builds (March 2019 cumulative or later strongly recommended)
$fixed = @{
    '14' = [version]'14.0.7237.5000'  # SharePoint 2010 SP2 + KB4462143
    '15' = [version]'15.0.5023.1000'  # SharePoint 2013 SP1 + KB4462211 / KB4464534
    '16.0.4' = [version]'16.0.4795.1000'  # SharePoint 2016 + KB4462184
    '16.0.10' = [version]'16.0.10340.12101' # SharePoint 2019 + KB4462199
}

try {
    $reg = Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Office Server\' -ErrorAction Stop |
        Where-Object { $_.PSChildName -match '^\d+\.\d+$' }
} catch {
    Write-Output 'UNKNOWN: SharePoint not installed or registry inaccessible'
    exit 2
}

$verdict = 'PATCHED'
foreach ($k in $reg) {
    $major = $k.PSChildName
    $installed = Get-ItemProperty $k.PSPath | Select-Object -ExpandProperty BuildVersion -ErrorAction SilentlyContinue
    if (-not $installed) { continue }
    $iv = [version]$installed

    $key = if ($major -eq '16.0' -and $iv.Build -ge 10000) { '16.0.10' }
           elseif ($major -eq '16.0') { '16.0.4' }
           else { $major.Split('.')[0] }

    if ($fixed.ContainsKey($key)) {
        if ($iv -lt $fixed[$key]) {
            Write-Output "VULNERABLE: SharePoint $major build $iv < required $($fixed[$key])"
            $verdict = 'VULNERABLE'
        } else {
            Write-Output "PATCHED: SharePoint $major build $iv"
        }
    } else {
        Write-Output "UNKNOWN: unrecognized SharePoint major $major"
        if ($verdict -eq 'PATCHED') { $verdict = 'UNKNOWN' }
    }
}

switch ($verdict) {
    'VULNERABLE' { exit 1 }
    'UNKNOWN'    { exit 2 }
    default      { exit 0 }
}