# Embedding Payloads and Bypassing Controls in Microsoft InfoPath

InfoPath .xsn manifest tweaks bypass managed-code warning and publishUrl domain restriction, and taskpane href accepts arbitrary executables/HTA for payload delivery.

- Payout: Research
- Severity: medium
- Program: Microsoft
- Write-up by: Eugene Lim
- Disclosed: 2022-06-18
- Write-up quality: 7/10
- Original: https://spaceraccoon.dev/embedding-payloads-bypassing-controls-microsoft-infopath/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath
- Tags: area:os domain:desktop impact:rce kind:research platform:research sev:medium tech:windows technique:source-review vuln:auth-bypass vuln:business-logic vuln:misconfiguration

**Target:** InfoPath .xsn form template manifest (manifest.xsf) and custom taskpane
**Root cause:** Manifest properties are trusted for security decisions: setting managedCode enabled=no suppresses the code warning while code still runs, removing publishUrl skips the Domain location check, and taskpane href is not restricted to embedded HTML.
**Steps:**
1. Extract .xsn (CAB) to get manifest.xsf, schema, template.xml.
2. Set `<xsf2:managedCode ... enabled="no">` while keeping rootAssembly DLL; open form — managed code runs without warning dialog.
3. For script-only Domain forms, delete the `publishUrl` attribute from `<xsf:xDocumentClass>`; form opens outside its publication location without error.
4. Set `<xsf:taskpane caption="test" href="calc.exe">` (or .hta/JScript/custom URI) referencing an embedded resource; taskpane renders in IE engine and executes without remote-connection warning.
**How found:** Spotted FormServer.aspx?XsnLocation= URL on SharePoint, downloaded the .xsn, unpacked the CAB and read manifest.xsf, then experimented flipping manifest properties (enabled, publishUrl, taskpane href) to test the three-tier security model.
**Exploitation:** Deliver a crafted .xsn to a victim; embedded taskpane href pointing at an embedded .hta/executable or custom URI executes in the IE engine on form open, bypassing the remote-URL warning; managed code runs silently via enabled=no.
**Escalation:** Potential no-click exploit via IE/JScript engine memory corruption; custom URI delivery (Follina-style) noted but ms-msdt no longer worked.
**Insight:** When a format gates security on a manifest flag (enabled=yes, publishUrl presence), try flipping/removing the flag — the enforcement and the feature often read different fields. Also test GUI-restricted file-type fields (href only .html) by editing raw manifest to other extensions/URIs.