Loading vulnerability…
Remote Code Execution in Microsoft SharePoint Server
CVE-2024-38018 is a critical remote code execution vulnerability in Microsoft SharePoint Server caused by deserialization of untrusted data. Available reporting attributes the issue to SharePoint deserialization logic, including the SPSerializationBinder.IsAllowedType() path, where insufficient restriction of deserializable types can allow attacker-controlled data to be deserialized in an unsafe manner. Microsoft assessed the issue as more likely to be exploited and assigned it a CVSS v3 score of 8.8. The vulnerability affects on-premises SharePoint Server deployments and can be abused by an authenticated attacker with at least Site Member privileges. Successful exploitation does not require user interaction and can result in execution of arbitrary code on the SharePoint server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can lead to arbitrary code execution in the context of the vulnerable SharePoint Server application. This can enable full compromise of the SharePoint instance, deployment of server-side malicious code, access to hosted content and application data, and potential follow-on activity such as persistence and lateral movement within the environment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting SharePoint permissions, especially Site Member and higher roles, auditing and restricting accounts that can create or modify site content, and minimizing access to vulnerable on-premises SharePoint instances. Closely monitor SharePoint for anomalous authenticated activity indicative of exploitation. Temporary custom binary modifications have been discussed publicly for unsupported versions, but these are operationally risky and should not be treated as a substitute for vendor-supported patching and platform upgrade.
Patch, then assume compromise.
Apply the Microsoft security updates released in September 2024 for supported Microsoft SharePoint Server versions. Organizations running unsupported SharePoint releases should upgrade to a supported version and then apply current security updates, as unsupported versions may not receive official fixes for this vulnerability class.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.