A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input…

CVE-2020-0646 is a code-injection flaw in the .NET Framework's System.Workflow.Activities namespace. When SharePoint on-premise processes XOML (Extensible Object Markup Language) workflow definitions, the CallExternalMethodActivity's InterfaceType attribute is compiled into C# without sanitizing embedded characters. An authenticated SharePoint user can inject arbitrary C# into the generated code, achieving remote code execution as the SharePoint application pool identity — typically a high-privilege domain service account. Affected .NET Framework versions include 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, and 4.8 on Windows Server. The vulnerability was patched in the January 2020 .NET Framework cumulative update.

Microsoft scored this 9.8 CRITICAL with a CVSS vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — but the PR:N is demonstrably wrong. The MDSec disclosure and the Metasploit module both confirm that authenticated SharePoint access is required (the SOAP call to webpartpages.asmx needs a valid session). A corrected vector with PR:L would land around 8.8. That said, the vulnerability is KEV-listed with confirmed in-the-wild exploitation, has a rock-solid Metasploit module rated 'excellent', and EPSS sits at the 99th percentile. The vendor severity label of CRITICAL is directionally correct despite the inflated vector — any SharePoint user counts as 'authenticated', which in most enterprises means thousands of potential attackers including compromised accounts.

Why this verdict

• Incorrect CVSS vector, but direction is right: Microsoft's PR:N is wrong — authentication is required. A corrected vector yields ~8.8 rather than 9.8. However, the authentication bar (any SharePoint user) is low enough that this does not warrant a severity downgrade from CRITICAL.
• KEV + EPSS 99th percentile: Confirmed exploitation in the wild with CISA KEV listing since November 2021. EPSS of 0.99 places this in the top 1% of all CVEs for exploitation probability. These are hard overrides against any downgrade.
• Metasploit 'excellent' module: The exploit is fully weaponized, deterministic, and requires zero manual effort. Point-and-shoot RCE once you have a SharePoint session cookie.
• Role multiplier: SharePoint on-premise is a high-value target in enterprise environments. (a) *Low-value role:* dev/test SharePoint — exploitation yields local server access only, blast radius = host. (b) *Typical role:* production SharePoint — contains sensitive documents, PII, intellectual property; service account is domain-joined with elevated privileges; blast radius = tenant + lateral movement. (c) *High-value role:* SharePoint integrated with AD, running as a domain service account with delegation rights — compromise enables Kerberos ticket harvesting, potential domain escalation; blast radius = domain. SharePoint on-premise represents ≥10% high-value-role deployments by definition (it's a core collaboration platform with privileged service accounts), so the verdict floor is CRITICAL.
• Vulnerability age: Patched in January 2020 — over 6 years ago. Any system still unpatched represents a severe configuration management failure and likely has other unpatched vulnerabilities compounding risk.

Why not higher?

This is already CRITICAL, the highest severity bucket. The reassessed score of 9.0 (vs. vendor's 9.8) reflects the authentication requirement that Microsoft's CVSS vector incorrectly omits — PR should be L, not N. A perfect 10.0 would require true unauthenticated, wormable exploitation.

Why not lower?

KEV listing and active exploitation are hard floors that prevent any downgrade below CRITICAL for a vulnerability with this blast radius. The authentication requirement (any SharePoint user) does not materially reduce the threat population — in a typical enterprise, thousands of accounts qualify, and any single compromised credential suffices. The Metasploit module eliminates all exploitation complexity. SharePoint servers are domain-joined, high-privilege assets where code execution cascades into lateral movement.

1. Patch .NET Framework immediately — Apply the January 2020 .NET Framework security update to all SharePoint on-premise servers. This is a 6-year-old patch — per the noisgate mitigation SLA for CRITICAL, compensating controls should be deployed within 3 days, but the actual fix (the patch itself) should be applied within hours given the KEV listing and exploitation history.
2. Deploy WAF rules blocking XOML injection — Configure your WAF (if fronting SharePoint) to inspect SOAP request bodies to webpartpages.asmx for the ValidateWorkflowMarkupAndCreateSupportObjects method with suspicious InterfaceType attribute values containing C# syntax (semicolons, braces, System.Diagnostics). Deploy within 3 days per noisgate mitigation SLA.
3. Monitor w3wp.exe child processes via EDR — Create an EDR detection rule alerting on any child process spawned by w3wp.exe on SharePoint servers — especially cmd.exe, powershell.exe, or any unsigned binary. This catches post-exploitation regardless of the injection vector. Deploy within 3 days.
4. Restrict SharePoint workflow permissions — Audit and reduce the set of users who can create or modify SharePoint workflows. Remove workflow creation rights from standard users if business processes allow. This shrinks the authenticated attacker population.
5. Network-segment SharePoint servers — Ensure SharePoint servers cannot initiate outbound connections to arbitrary hosts (limits C2) and restrict lateral movement by placing them in a dedicated VLAN with controlled egress. Deploy within 3 days.

Run this on each SharePoint server with administrator privileges. Execute: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2020-0646.ps1. The script checks the installed .NET Framework versions and verifies whether the January 2020 security updates are applied.

# Check-CVE-2020-0646.ps1
# Checks whether the January 2020 .NET Framework patches for CVE-2020-0646 are installed.
# Run on: SharePoint on-premise servers
# Requires: Administrator privileges
# Output: VULNERABLE / PATCHED / UNKNOWN

$ErrorActionPreference = 'Stop'

try {
    # Known KBs for the January 2020 .NET Framework security update
    $patchKBs = @(
        'KB4532938','KB4532950','KB4532951','KB4532952',
        'KB4532958','KB4532959','KB4532960','KB4532961',
        'KB4532962','KB4534978','KB4534976','KB4534977',
        'KB4535101','KB4535102','KB4535103','KB4535104',
        'KB4535105'
    )

    # Check for installed hotfixes matching the patch KBs
    $installedKBs = Get-HotFix -ErrorAction SilentlyContinue | Select-Object -ExpandProperty HotFixID

    # Also check via registry for .NET Framework updates
    $netRegPath = 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full'
    $netRelease = 0
    if (Test-Path $netRegPath) {
        $netRelease = (Get-ItemProperty $netRegPath -Name Release -ErrorAction SilentlyContinue).Release
    }

    # Check if SharePoint is installed
    $spInstalled = $false
    $spSnapin = Get-PSSnapin -Registered -Name 'Microsoft.SharePoint.PowerShell' -ErrorAction SilentlyContinue
    if ($spSnapin) { $spInstalled = $true }
    if (-not $spInstalled) {
        $spHive = 'HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions'
        if (Test-Path $spHive) {
            $versions = Get-ChildItem $spHive -ErrorAction SilentlyContinue
            foreach ($v in $versions) {
                $loc = (Get-ItemProperty $v.PSPath -Name 'Location' -ErrorAction SilentlyContinue).Location
                if ($loc -and (Test-Path (Join-Path $loc 'ISAPI\Microsoft.SharePoint.dll'))) {
                    $spInstalled = $true
                    break
                }
            }
        }
    }

    if (-not $spInstalled) {
        Write-Host 'UNKNOWN - SharePoint not detected on this host. CVE-2020-0646 is exploitable via SharePoint workflows.'
        exit 2
    }

    $foundPatch = $false
    foreach ($kb in $patchKBs) {
        if ($installedKBs -contains $kb) {
            $foundPatch = $true
            Write-Host "PATCHED - Found $kb (January 2020 .NET Framework security update) on this SharePoint server."
            break
        }
    }

    if (-not $foundPatch) {
        # Fallback: check if any .NET cumulative update post-Jan 2020 is installed
        $postJan2020 = Get-HotFix -ErrorAction SilentlyContinue | Where-Object {
            $_.InstalledOn -gt [datetime]'2020-01-14' -and $_.Description -match 'Security Update'
        } | Where-Object { $_.HotFixID -match 'KB4' }

        if ($postJan2020) {
            Write-Host "PATCHED - Post-January 2020 security updates detected. Verify .NET Framework patches specifically."
            exit 0
        } else {
            Write-Host 'VULNERABLE - No January 2020 .NET Framework security update (or later) found. CVE-2020-0646 is exploitable.'
            exit 1
        }
    } else {
        exit 0
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $_"
    exit 2
}

Sources

1. MDSec - Code Injection in Workflows Leading to SharePoint RCE
2. Microsoft Security Update Guide - CVE-2020-0646
3. Metasploit Module - SharePoint Workflows XOML Injection
4. Exploit-DB #48275 - SharePoint Workflows XOML Injection
5. CISA Known Exploited Vulnerabilities Catalog
6. Metasploit PR #13122 - CVE-2020-0646 Module
7. Senserva - CVE-2020-0646 Advisory