SharePoint WebPartPages.asmx GetWebPartPageConnectionInfo Register directive abu

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects malicious exploitation attempts against the SharePoint WebPartPages.asmx SOAP endpoint. Attackers use this endpoint to bypass security patches by invoking template-parsing functions like GetWebPartPageConnectionInfo, which facilitates Register-directive injection and XamlServices deserialization chains for remote code execution.