Loading vulnerability…
CVE-2020-1147 is a remote code execution vulnerability affecting Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio. The flaw is caused by improper validation of XML file input markup: the software fails to adequately check the source markup of supplied XML content before processing it. Available reporting also describes the issue as a deserialization-related flaw in SharePoint exploitation scenarios, where attacker-controlled XML content can be used to reach unsafe object processing paths. In practical SharePoint exploitation, the vulnerability has been used to obtain code execution even when the application pool identity had limited filesystem privileges, enabling post-exploitation techniques such as in-memory or virtual web shell deployment rather than direct writes to web directories.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository contains a single Metasploit module targeting Microsoft SharePoint servers vulnerable to CVE-2020-1147, a remote code execution flaw due to unsafe XML deserialization in the DataSet/DataTable classes. The exploit requires valid domain user credentials and targets the '/_layouts/15/quicklinks.aspx' endpoint, abusing the 'Mode=Suggestion' parameter to deliver a maliciously crafted XML payload. The module supports multiple payload types, including Windows command execution, EXE dropper, and PowerShell, leveraging Metasploit's payload framework. The exploit is weaponized, providing reliable remote code execution as the SharePoint application service account. The code is well-structured, with clear separation of check and exploit logic, and uses Metasploit's HttpClient and CmdStager mixins for network communication and payload delivery. The only fingerprintable endpoint is the SharePoint quicklinks page, which is used both for detection and exploitation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An older .NET Framework/SharePoint/Visual Studio remote code execution vulnerability whose exploit is described as nearly identical to the CVE-2025-49704/CVE-2025-53770 exploit chain.
A SharePoint deserialization-based remote code execution vulnerability that can be exploited to execute code and deploy in-memory or virtual web shells, including via YSoSerial.Net payloads.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.