SharePointi töövood lõpetavad töötamise pärast .NET-i turvavärskenduste installimist CVE-2018-8421

Sümptomid

Pärast seda, kui olete installinud mis tahes septembri 2018 .NET Frameworki turvavärskenduste lahendamiseks CVE-2018-8421 (.NET Framework koodi kaugkäivitamist haavatavus), lõpetage SharePointi välised töövood. Selle probleemi ilmnemisel logitakse järgmine tõrketeade, mis sarnaneb järgmisega:

<Date> <Time> w3wp.exe (0x1868) 0x22FC SharePoint Foundation Workflow Infrastructure 72fs Unexpected RunWorkflow: Microsoft.SharePoint.SPException: <Error><CompilerError Line="-1" Column="-1" Text="Type System.CodeDom.CodeBinaryOperatorExpression is not marked as authorized in the application configuration file." /><CompilerError Line="-1" Column="-1" Text="Type System.CodeDom.CodeBinaryOperatorExpression is not marked as authorized in the application configuration file." /><CompilerError Line="-1" Column="-1" Text="Type System.CodeDom.CodeBinaryOperatorExpression is not marked as authorized in the application configuration file." /><CompilerError Line="-1" Column="-1" Text="Type System.CodeDom.CodeBinaryOperatorExpression is not marked as authorized in the application configuration file." /><CompilerError Line="-1" Column="-1" Text="Type System.CodeDom.CodeBinaryOperatorExpression is not marked as authorized in the application configuration file." /><CompilerError Line="-1" Column="-1" Text="Type System.CodeDom.CodeBinaryOperatorExpression is not marked as authorized in the application configuration file." /><CompilerError Line="-1" Column="-1" Text="Type System.CodeDom.CodeBinaryOperatorExpression is not marked as authorized in the application configuration file." /><CompilerError Line="-1" Column="-1"…

Tõrketeade viitab sellele, et System. CodeDom. CodeBinaryOperatorExpression ei kuulu lubatud tüüpi.

Lisateavet septembri .NET turbevärskenduse kohta leiate teemast Microsoft .net ' i ajaveebi leht.

Põhjus

Töövoo Sihtasutus (WF) käivitab töövood ainult siis, kui kõik sõltuvad tüübid ja assemblerid on lubatud .NET-i konfiguratsioonifaili (või on lisatud selgesõnaliselt koodiga) järgmises puus.

<configuration>

<System.Workflow.ComponentModel.WorkflowCompiler>

<authorizedTypes>

<targetFx>

Kuid pärast värskendamist on vaja, et mõned failitüübid, mida varem pole varem nõutud, poleks praegu nõutavad.

Lahendus

Selle probleemi lahendamiseks rakendage järgmisi teabebaasi artiklitest vastavaid turbe-ja turbega seotud värskendusi.

4461501 SharePoint Enterprise Server 2016 turbevärskenduse kirjeldus: 13 November 2018 4461508 November 13, 2018, koondvärskenduses SharePoint Foundation 2013 (KB4461508) 4461510 November 13, 2018, koondvärskenduses SharePoint Enterprise Server 2013 (KB4461510)   4011713 November 13, 2018, Update for SharePoint Foundation 2010 (KB4011713) 4461528 November 13, 2018, koondvärskenduses SharePoint Server 2010 (KB4461528)

Märkused

  • Kui värskendus on installitud, peab SharePointi toodete konfigureerimisviisard käivitama, et lahendus oleks täielikult rakendatav.

  • Mõnel kolmanda osapoole või kohandatud töövoo toimingutel võib olla täiendavaid sõltuvusi. Kui teil ilmneb selle probleemiga sarnane käitumine, mida selles artiklis ei käsitleta, lugege abi saamiseks töövoo toimingu arendajat.

Lahendus

Selle probleemi lahendamiseks lisage vajalikud tüübid kõigi rakenduste failis web. config. Kuigi juhised on ette nähtud, soovitame kasutada skripti meetodit. 

Selle probleemi lahendamiseks lisage kõigi rakenduste Web. config failidele selgesõnaliselt vajalikud tüübid.

SharePoint 2013 ja uuemad versioonid

SharePointi 2013 ja uuemate versioonide korral lisage järgmised read.

<authorizedType Assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodeBinaryOperatorExpression" Authorized="True" />

<authorizedType Assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodePrimitiveExpression" Authorized="True" />

<authorizedType Assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodeMethodInvokeExpression" Authorized="True" />

<authorizedType Assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodeMethodReferenceExpression" Authorized="True" />

<authorizedType Assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodeFieldReferenceExpression" Authorized="True" />

<authorizedType Assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodeThisReferenceExpression" Authorized="True" />

<authorizedType Assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodePropertyReferenceExpression" Authorized="True" />  

SharePointi versioonid, mis on vanemad kui SharePoint 2013

Kui olete varem kui 2013 SharePointi versioonid, lisage selle asemel järgmised read.

<authorizedType Assembly="System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodeBinaryOperatorExpression" Authorized="True" />

<authorizedType Assembly="System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodePrimitiveExpression" Authorized="True" />

<authorizedType Assembly="System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodeMethodInvokeExpression" Authorized="True" />

<authorizedType Assembly="System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodeMethodReferenceExpression" Authorized="True" />

<authorizedType Assembly="System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodeFieldReferenceExpression" Authorized="True" />

<authorizedType Assembly="System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodeThisReferenceExpression" Authorized="True" />

<authorizedType Assembly="System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" NameSpace="System.CodeDom" TypeName="CodePropertyReferenceExpression" Authorized="True" />

Soovitame kasutada järgmist skripti, mitte olemasolevaid faile otse muutma.

Märkus.Mõned kolmanda osapoole töövoo mootorid võivad nõuda täiendavate tüüpide lisamist. Sellisel juhul võtke ühendust tarnijaga, et saada teavet nõutavate tüüpide kohta, ja seejärel Kohandage skripti vastavalt.

Järgmine skript muudab kõik veebirakendused Web. config, et lisada vajalikud kirjed. See skript lisab need tüübid olemasolevatele veebirakendustele ja rakendustele, mis luuakse pärast skripti käivitamist. Skripti tuleks kasutada ainult ühe korra iga serveripargi veebieesserver serveris (see värskendab kõik serverid).

<#

 This script adds the entries to all web.config files for all web applications in the farm.

 Run this script as Farm Administrator in one of the WFEs.

 This script has to run only one time.

SUMMARY:

This script uses the native SharePoint SPWebConfigModification API to deploy new updates to the web.config file for each web application on each server in the farm.  Servers that are added at a later date will also get the updates applied because the API configuration is persisted in the config database.  This API does not update the web.config for the central administration web application.

If you are running workflows on the central admin web application, you will have to manually update the web.config by using the steps in the referenced blog.

==============================================================

#>

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue | Out-Null

function Add-CodeDomAuthorizedType

{

    <#

    .Synopsis

       Adds the necessary authorizedType elements to all web.config files for all non-central admin web applications

 

    .DESCRIPTION

       Adds the necessary authorizedType elements to all web.config files for all non-central admin web applications

 

    .EXAMPLE

       Add-CodeDomAuthorizedType

 

    #>

    [CmdletBinding()]

    param

    (

    )

    begin

    {

        $farmMajorVersion = (Get-SPFarm -Verbose:$false ).BuildVersion.Major

        $contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService

        $typeNames = @( "CodeBinaryOperatorExpression", "CodePrimitiveExpression", "CodeMethodInvokeExpression", "CodeMethodReferenceExpression", "CodeFieldReferenceExpression","CodeThisReferenceExpression", "CodePropertyReferenceExpression")

   

    }

    process

    {

        if( @($contentService.WebConfigModifications | ? { $_.Name -eq "NetFrameworkAuthorizedTypeUpdate" }).Count -gt 0 )

        {

            Write-Warning "Existing NetFrameworkAuthorizedTypeUpdate entries found, this script has to be run only one time per farm."

            return

        }

        if( $farmMajorVersion -le 14 ) # 2010, 2007

        {

            foreach( $typeName in $typeNames )

            {

                # System, Version=2.0.0.0

                $netFrameworkConfig = New-Object Microsoft.SharePoint.Administration.SPWebConfigModification

                $netFrameworkConfig.Path     = "configuration/System.Workflow.ComponentModel.WorkflowCompiler/authorizedTypes"

                $netFrameworkConfig.Name     = "authorizedType[@Assembly='System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'][@Namespace='System.CodeDom'][@TypeName='{0}'][@Authorized='True']" -f $typeName

                $netFrameworkConfig.Owner    = "NetFrameworkAuthorizedTypeUpdate"

                $netFrameworkConfig.Sequence = 0

                $netFrameworkConfig.Type     = [Microsoft.SharePoint.Administration.SPWebConfigModification+SPWebConfigModificationType]::EnsureChildNode

                $netFrameworkConfig.Value    = '<authorizedType Assembly="System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Namespace="System.CodeDom" TypeName="{0}" Authorized="True"/>' -f $typeName

           

                $contentService.WebConfigModifications.Add($netFrameworkConfig);

            }

        }

        else # 2013+

        {

            foreach( $typeName in $typeNames )

            {

                # System, Version=4.0.0.0

                $netFrameworkConfig = New-Object Microsoft.SharePoint.Administration.SPWebConfigModification

                $netFrameworkConfig.Path     = "configuration/System.Workflow.ComponentModel.WorkflowCompiler/authorizedTypes/targetFx"

                $netFrameworkConfig.Name     = "authorizedType[@Assembly='System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'][@Namespace='System.CodeDom'][@TypeName='{0}'][@Authorized='True']" -f $typeName

                $netFrameworkConfig.Owner    = "NetFrameworkAuthorizedTypeUpdate"

                $netFrameworkConfig.Sequence = 0

                $netFrameworkConfig.Type     = [Microsoft.SharePoint.Administration.SPWebConfigModification+SPWebConfigModificationType]::EnsureChildNode

                $netFrameworkConfig.Value    = '<authorizedType Assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Namespace="System.CodeDom" TypeName="{0}" Authorized="True"/>' -f $typeName

           

                $contentService.WebConfigModifications.Add($netFrameworkConfig);

            }

        }

        Write-Verbose "Updating web.configs"

        $contentService.Update()

        $contentService.ApplyWebConfigModifications();

    }

    end

    {

    }   

}

function Remove-CodeDomAuthorizedType

{

    <#

    .Synopsis

       Removes any web configuration entries owned by "NetFrameworkAuthorizedTypeUpdate"

 

    .DESCRIPTION

       Removes any web configuration entries owned by "NetFrameworkAuthorizedTypeUpdate"

 

    .EXAMPLE

        Remove-CodeDomAuthorizedType

    #>

    [CmdletBinding()]

    param()

    begin

    {

        $contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService

    }

    process

    {

        $webConfigModifications = @($contentService.WebConfigModifications | ? { $_.Owner -eq "NetFrameworkAuthorizedTypeUpdate" })

        foreach ( $webConfigModification in $webConfigModifications )

        {

            Write-Verbose "Found instance owned by NetFrameworkAuthorizedTypeUpdate"

            $contentService.WebConfigModifications.Remove( $webConfigModification ) | Out-Null

        }

        

        if( $webConfigModifications.Count -gt 0 )

        {

            $contentService.Update()

            $contentService.ApplyWebConfigModifications()

        }

    }

    end

    {

    }   

}

# The following command will get the timerjob responsible for the web.config change deployment

# Get-SPTimerJob | ? { $_.Name -eq "job-webconfig-modification" }

 

# The following command will make the appropriate changes

Add-CodeDomAuthorizedType

# Remove the following command if you have to remove the web.config updates, you can use this function to retract the changes

# Remove-CodeDomAuthorizedType

Kas vajate veel abi?

Täiendage oma oskusi
Tutvuge koolitusmaterjalidega
Kasutage uusi funktsioone enne teisi
Liitu Microsofti Insideri programmis osalejad

Kas sellest teabest oli abi?

Täname tagasiside eest!

Täname tagasiside eest! Tundub, et võiksime teid kokku viia ühega meie Office'i tugiagentidest, kes aitab teil probleemi lahendada.

×