Loading vulnerability…
Remote Code Execution in Microsoft SharePoint Server
CVE-2024-43464 is a critical remote code execution vulnerability in Microsoft SharePoint Server caused by deserialization of untrusted data. The flaw can be triggered when an attacker with sufficient SharePoint privileges uploads a specially crafted file and then sends a specially crafted API request that causes SharePoint Server to deserialize attacker-controlled parameters from that file. Successful exploitation results in code execution in the context of the SharePoint Server. Microsoft assessed exploitation as more likely within 30 days of disclosure.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows remote code execution on the affected SharePoint Server. Because exploitation occurs in the server context, an attacker can execute arbitrary code within the privileges of the SharePoint application environment, which can enable further compromise of the SharePoint instance and potentially broader post-exploitation activity within the enterprise environment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting access to vulnerable SharePoint instances, limiting who can upload files and invoke relevant API functionality, and minimizing assignment of Site Owner or higher privileges. Monitor SharePoint for suspicious file uploads and anomalous crafted API activity that could indicate exploitation attempts. These measures only reduce risk and do not eliminate the underlying vulnerability.
Patch, then assume compromise.
Apply the Microsoft security updates released for Microsoft SharePoint Server that address CVE-2024-43464. Priority should be given to internet-exposed or otherwise reachable SharePoint deployments and to environments where users hold elevated site-level privileges such as Site Owner. Standard patch validation and accelerated deployment are warranted given Microsoft's assessment that exploitation is more likely.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.