Microsoft SharePoint CVE-2019
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0604 | RCE in Microsoft SharePoint via Application Package Markup Validation Flaw Microsoft SharePoint fails to check the source markup of an application package, an improper input validation flaw (CWE-20) that allows maliciously crafted markup to be processed by the server. An attacker triggers the flaw by getting an affected SharePoint server to handle a crafted application package, without any special privileges described in the disclosure. Successful exploitation lets the attacker run remote code in the context of the SharePoint application pool and the SharePoint server farm account, providing control of the web server and access to a highly privileged farm-level identity. Any organization running an affected on-premises Microsoft SharePoint deployment is exposed, with internet-facing SharePoint servers at greatest risk. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and EPSS puts the probability of exploitation at 99.9%, although no public proof-of-concept is catalogued. Do: Apply Microsoft's SharePoint security updates per vendor instructions immediately, prioritizing internet-exposed SharePoint servers as CISA's required action directs. Given known in-the-wild and ransomware use, hunt for signs of compromise such as unexpected .aspx or webshell files in SharePoint directories and anomalous use of the SharePoint farm account. Restrict or firewall internet exposure of SharePoint servers until patches are confirmed applied. | 9.8 | 100% | KEV ransomware |
| mass≈ hundreds of thousands of on-prem SharePoint server deployments worldwide, of which tens of thousands are directly internet-facing (estimate) |
Full article370 words · extracted from securityaffairs.com · click to collapse
According to researchers at AT&T Alien Labs, threat actors are attempting to exploit the CVE-2019-0604 Microsoft Sharepoint vulnerability in attacks in the wild.
AlienLabs has seen a number of reports related to the active exploitation of the CVE-2019-0604 vulnerability in Microsoft Sharepoint.
The CVE-2019-0604 vulnerability is a remote code execution flaw that is caused by the failure of SharePoint in verifying the source markup of an application package. An attacker could exploit the flaw by uploading a specially crafted SharePoint application package to affected versions of the software.
“A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.” reads the security advisory published by Microsoft. “An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.”
“Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected versions of SharePoint.”
AT&T Alien Labs researchers reported attempts of exploitation against organizations in Saudi Arabia and Canada.
A report by the Saudi Cyber Security Centre suggests threat actors are primarily targeting organizations within the kingdom. The Canadian Cyber Security Centre reported similar attacks aimed at delivering the China Chopper web-shell to ensure persistence in the target networks.
“AlienLabs has identified malware (https://pastebin.com/bUFPhucz) that is likely an earlier version of the second-stage malware deployed in the Saudi Intrusions.” reads the analysis published AlienVault. “This malware sample was shared by a target in China.”
The malware supports several commands, including downloading and uploading files, that receives at http://$SERVER/Temporary_Listen_Addresses/SMSSERVICE.
According to the experts, one user on Twitter reported that source of attacks was the IP address 194.36.189[.]177. which was previously associated with FIN7 cybercrime group.
The good news for Microsoft users is that the tech giant already issued a patch for the CVE-2019-0604 vulnerability in the Patch Tuesday updates for February 2019.
According to the experts, multiple threat actors are attempting to exploit CVE-2019-0604 vulnerability.
AT&T Alien Labs researchers published Yara rules for the detections of the exploit code used by the attackers here:
https://www.alienvault.com/blogs/labs-research/sharepoint-vulnerability-exploited-in-the-wild/
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – CVE-2019-0604, Microsoft Sharepoint
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/85324/breaking-news/ms-sharepoint-cve-2019-0604-flaw.html