CVE-2021-34520: 
vulnerability analysis and mitigation

Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520) was disclosed on June 9, 2021. The vulnerability affects Microsoft SharePoint Server installations and requires authentication to exploit. This security flaw was addressed as part of Microsoft's July 2021 security updates (ZDI Advisory).

The vulnerability exists within the Microsoft.SharePoint.WorkflowActions.SetVariableActivity class. The specific flaw involves deserialization of untrusted data, where a crafted SetVariableActivity element can result in instantiation of an arbitrary .NET type. The vulnerability has been assigned a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating its high severity (ZDI Advisory).

If successfully exploited, this vulnerability allows authenticated remote attackers to execute arbitrary code in the context of the web service account on affected SharePoint Server installations (ZDI Advisory).

The vulnerability requires authentication for exploitation, meaning an attacker would need valid credentials to target the system. The vulnerability was reported to Microsoft on March 26, 2021, and was publicly disclosed on July 19, 2021, following the release of security patches (ZDI Advisory).

Microsoft released security updates to address this vulnerability in July 2021. The fix was included in KB5001976 for SharePoint Enterprise Server 2016. After installing the security update, users should be aware that existing Microsoft SharePoint 2010 workflows might stop functioning, with specific event tags (c42q8, c42ra, or c42rh) being logged in the SharePoint Unified Logging System (ULS) log (Microsoft Support).