SharePoint WebPartPages.asmx GetWebPartPageConnectionInfo Register Injection

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects an attempt to exploit a directive injection vulnerability in the SharePoint 'WebPartPages.asmx' SOAP web service, specifically targeting the 'GetWebPartPageConnectionInfo' method. The rule looks for suspicious 'Register' directives in the request body, which could lead to unauthorized code execution or configuration manipulation.